CVE-2023-25500

Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.

Scoring

Severity

LOW

CVSS base score

3.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

EPSS probability

0.29%

CWE

CWE-200

Published

2023-06-22

Last modified

2026-09-14

Affected products

• vaadin vaadin
• vaadin vaadin
• vaadin vaadin
• vaadin vaadin
• vaadin vaadin
• vaadin vaadin
• flow flow-server
• flow flow-server

Weakness type

• CWE-200

Related vulnerabilities

• CVE-2026-87820 — CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner
• CVE-2026-86464 — In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity
• CVE-2026-87541 — Information leak in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the
• CVE-2026-78960 — Information leak in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engin
• CVE-2026-87593 — Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive inform
• CVE-2026-87565 — Information leak in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to leak se
• CVE-2026-87545 — Information leak in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social
• CVE-2026-87490 — Information leak in Transactions Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain se

Markdown version · Browse all CVEs