PT-2023-20116 · Vaadin · Vaadin

Publicado 2023-06-22 · Atualizado 2023-06-30 · CVE-2023-25500

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vaadin versions 10.0.0 through 10.0.23 Vaadin versions 11.0.0 through 14.10.1 Vaadin versions 15.0.0 through 22.0.28 Vaadin versions 23.0.0 through 23.3.13 Vaadin versions 24.0.0 through 24.0.6 Vaadin versions 24.1.0.alpha1 through 24.1.0.rc2

Description The issue results in potential information disclosure of class and method names in RPC responses by sending modified requests.

Recommendations For Vaadin versions 10.0.0 through 10.0.23, update to a version outside of this range to mitigate the risk. For Vaadin versions 11.0.0 through 14.10.1, update to a version outside of this range to mitigate the risk. For Vaadin versions 15.0.0 through 22.0.28, update to a version outside of this range to mitigate the risk. For Vaadin versions 23.0.0 through 23.3.13, update to a version outside of this range to mitigate the risk. For Vaadin versions 24.0.0 through 24.0.6, update to a version outside of this range to mitigate the risk. For Vaadin versions 24.1.0.alpha1 through 24.1.0.rc2, update to a version outside of this range to mitigate the risk.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-1295

CWE-200

Identificadores relacionados

CVE-2023-25500

GHSA-CH48-9R3Q-PV7X

Produtos afetados

Vaadin

Referências · 8

• https://github.com/vaadin/flow/pull/16935 · Correção
• https://github.com/vaadin/platform · Nota
• https://github.com/vaadin/platform/security/advisories/GHSA-ch48-9r3q-pv7x · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25500 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25500 · Nota
• https://osv.dev/vulnerability/CVE-2023-25500 · Aviso do Fabricante
• https://vaadin.com/security/cve-2023-25500 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-ch48-9r3q-pv7x · Aviso do Fabricante