CVE-2023-25499

MediumCVSS 6.5/10Last modified Sep 14, 2026

Description

When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
vaadin	vaadin	>= 10.0.0, <= 10.0.22; >= 11.0.0, <= 14.10.0; >= 15.0.0, <= 22.0.28; >= 23.0.0, <= 23.3.12; >= 24.0.0, <= 24.0.5; >= 24.1.0.alpha1, <= 24.1.0.beta1
vaadin	flow-server	>= 1.0.0, <= 1.0.19; >= 1.1.0, <= 2.8.9; >= 2.9.0, < 2.9.1; >= 3.0.0, <= 9.1.0; >= 23.0.0, <= 23.3.10; >= 24.0.0, <= 24.0.7; >= 24.1.0.alpha1, <= 24.1.0.beta1

References

https://github.com/vaadin/flow/pull/15885Patch
https://vaadin.com/security/CVE-2023-25499Vendor Advisory
https://github.com/vaadin/flow/pull/15885Patch
https://vaadin.com/security/CVE-2023-25499Vendor Advisory

Timeline

Published: Jun 22, 2023
Last modified: Sep 14, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-25504.8Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.CVE-2023-255004.3Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1 CVE-2023-255046.5A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order CVE-2023-255057.8NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler of the AMI MegaRAC BMC , where an attacker with the appropriate level of autho CVE-2023-255068.2NVIDIA DGX-1 contains a vulnerability in Ofbd in AMI SBIOS, where a preconditioned heap can allow a user with elevated privileges to cause a CVE-2023-255078.8NVIDIA DGX-1 BMC contains a vulnerability in the SPX REST API, where an attacker with the appropriate level of authorization can inject arbi CVE-2023-255087.8NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler, where an attacker with the appropriate level of authorization can upload and CVE-2023-255097.8NVIDIA DGX-1 SBIOS contains a vulnerability in Bds, which may lead to code execution, denial of service, and escalation of privileges.CVE-2023-25518.8PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1.CVE-2023-255103.3NVIDIA CUDA Toolkit SDK for Linux and Windows contains a NULL pointer dereference in cuobjdump, where a local user running the tool against CVE-2023-255113.3NVIDIA CUDA Toolkit for Linux and Windows contains a vulnerability in cuobjdump, where a division-by-zero error may enable a user to cause a CVE-2023-255126.6NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in cuobjdump, where an attacker may cause an out-of-bounds memory read by