CVE-2023-25499

When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.

Scoring

Severity

MEDIUM

CVSS base score

5.7

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

EPSS probability

0.24%

CWE

CWE-200

Published

2023-06-22

Last modified

2026-09-14

Affected products

• vaadin vaadin
• vaadin vaadin
• vaadin vaadin
• vaadin vaadin
• vaadin vaadin
• vaadin vaadin
• vaadin flow-server
• vaadin flow-server

Weakness type

• CWE-200

Related vulnerabilities

• CVE-2026-92960 — vm2 before 3.11.6 Process-wide State Exposure via os and dns
• CVE-2026-92947 — vm2 before 3.11.7 Memory Disclosure via Buffer Pool
• CVE-2026-87820 — CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner
• CVE-2026-86464 — In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity
• CVE-2026-54617 — GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler
• CVE-2026-87541 — Information leak in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the
• CVE-2026-78960 — Information leak in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engin
• CVE-2026-87593 — Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive inform

Markdown version · Browse all CVEs