Possible information disclosure inside TreeGrid component with default data provider
CVE-2022-29567

5.7MEDIUM

Key Information:

Vendor

Vaadin

Status
Vaadin
Vaadin-grid-flow
Vendor
CVE Published:
24 May 2022

What is CVE-2022-29567?

The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

vaadin 14.8.5

vaadin <= 14.8.9

vaadin 22.0.6

References

https://vaadin.com/security/cve-2022-29567
x_refsource_MISC
https://github.com/vaadin/flow-components/pull/3046
x_refsource_MISC

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.