CVE-2023-25500: Vaadin RPC Response Information Disclosure
Summary
CVE-2023-25500: Vaadin vulnerable to possible information disclosure of class and method names in RPC response. Affects com.vaadin:flow-server across 6 version ranges.
>= 1.0.0, < 1.0.21
>= 1.1.0, < 2.9.3
>= 3.0.0, < 9.1.2
>= 23.0.0, < 23.3.13
>= 24.0.0, < 24.0.9
>= 24.1.alpha1, < 24.1.0
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vaadin is an open-source Java framework used for building web applications. It provides a set of user interface components and tools for creating modern and responsive web interfaces. The Vaadin framework includes a feature called RPC (Remote Procedure Call) that allows communication between the client-side and server-side components of a Vaadin application. This vulnerability affects versions 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2 of the Vaadin framework.
Vulnerability Detail
The vulnerability in Vaadin allows for potential information disclosure of class and method names in RPC responses. By sending modified requests, an attacker can exploit this vulnerability to obtain sensitive information about the server-side implementation of the Vaadin application. This information disclosure can potentially aid attackers in further exploiting the application or conducting targeted attacks.
How To Fix
Latest published version: 25.3.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.0.211.0.21 -
>= 1.1.0, < 2.9.32.9.3 -
>= 3.0.0, < 9.1.29.1.2 -
>= 23.0.0, < 23.3.1323.3.13 -
>= 24.0.0, < 24.0.924.0.9 -
>= 24.1.alpha1, < 24.1.024.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of the Vaadin framework.
Conclusion
The Vaadin framework is vulnerable to an information disclosure issue in RPC responses, which can potentially expose sensitive information about the server-side implementation of a Vaadin application. It is crucial to upgrade to the fixed versions of the framework to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for com.vaadin:flow-server →
FAQ
Vaadin is an open-source Java framework for building web applications. It provides a set of user interface components and tools for creating modern and responsive web interfaces.
RPC (Remote Procedure Call) is a feature in Vaadin that allows communication between the client-side and server-side components of a Vaadin application.
This vulnerability can potentially expose sensitive information about the server-side implementation of a Vaadin application, which can aid attackers in further exploiting the application or conducting targeted attacks.
Yes, versions 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, and 24.1.0 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of the Vaadin framework as mentioned in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.vaadin:flow-server.
