Show plain JSON{"id": "CVE-2023-25499", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@vaadin.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-06-22T13:15:09.660", "references": [{"url": "https://github.com/vaadin/flow/pull/15885", "tags": ["Patch"], "source": "security@vaadin.com"}, {"url": "https://vaadin.com/security/CVE-2023-25499", "tags": ["Vendor Advisory"], "source": "security@vaadin.com"}, {"url": "https://github.com/vaadin/flow/pull/15885", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vaadin.com/security/CVE-2023-25499", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@vaadin.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.\n\n"}], "lastModified": "2024-11-21T07:49:37.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12F1F29D-69E8-406E-BB2F-EA3F141CECD7", "versionEndExcluding": "10.0.23", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B100421F-58C7-454A-949C-338C4B990925", "versionEndExcluding": "14.10.1", "versionStartIncluding": "11.0.0"}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0719ACD-F9D0-4E28-82BC-AEFE4EB19729", "versionEndIncluding": "22.0.28", "versionStartIncluding": "15.0.0"}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74BA613E-932F-45A3-88D2-EA8B42158429", "versionEndExcluding": "23.3.13", "versionStartIncluding": "23.0.0"}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F7402D6-2F33-4352-9E70-16EA3C45B795", "versionEndExcluding": "24.0.6", "versionStartIncluding": "24.0.0"}, {"criteria": "cpe:2.3:a:vaadin:vaadin:24.1.0:alpha1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5131784E-6951-4BA6-A473-10BE06E3E0F0"}, {"criteria": "cpe:2.3:a:vaadin:vaadin:24.1.0:alpha2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07747F12-9827-4543-B66F-253326EC247F"}, {"criteria": "cpe:2.3:a:vaadin:vaadin:24.1.0:alpha3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD57A5F3-CB86-4B35-823B-DCAEB163D4CD"}, {"criteria": "cpe:2.3:a:vaadin:vaadin:24.1.0:alpha4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB94F579-CDCE-4FA4-BCAF-7747813FB7A6"}, {"criteria": "cpe:2.3:a:vaadin:vaadin:24.1.0:alpha5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4464403F-682A-4506-99E7-2CC4E4288C0E"}, {"criteria": "cpe:2.3:a:vaadin:vaadin:24.1.0:alpha6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ECF91FB7-2806-40C1-B27D-461B6836AC7A"}, {"criteria": "cpe:2.3:a:vaadin:vaadin:24.1.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4ECE8939-9AB8-44AB-8ECC-96844410A973"}], "operator": "OR"}]}], "sourceIdentifier": "security@vaadin.com"} 