# CVE-2023-25500

## Summary

- **CVE ID:** CVE-2023-25500
- **Severity:** LOW
- **CVSS Score:** 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)
- **CWE:** CWE-200
- **Published:** Jun 22, 2023
- **Last Modified:** Sep 14, 2026

## Description

Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.

## Affected Products

- vaadin — vaadin (10.0.0)
- vaadin — vaadin (11.0.0)
- vaadin — vaadin (15.0.0)
- vaadin — vaadin (23.0.0)
- vaadin — vaadin (24.0.0)
- vaadin — vaadin (24.1.0.alpha1)
- flow — flow-server (1.0.0)
- flow — flow-server (1.1.0)
- flow — flow-server (3.0.0)
- flow — flow-server (23.0.0)
- flow — flow-server (24.0.0)
- flow — flow-server (24.1.0.alpha1)

## References

- [CNA](https://github.com/vaadin/flow/pull/16935)
- [CNA](https://vaadin.com/security/cve-2023-25500)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.29%
- **EPSS Percentile:** 52.5

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._