title: Possible information disclosure in non visible components
description: When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.
problem types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
defaultStatus: unaffected
product: vaadin
repo: https://github.com/vaadin/platform
vendor: vaadin
versions:
lessThanOrEqual: 10.0.22, status: affected, version: 10.0.0, versionType: maven
lessThanOrEqual: 14.10.0, status: affected, version: 11.0.0, versionType: maven
lessThanOrEqual: 22.0.28, status: affected, version: 15.0.0, versionType: maven
lessThanOrEqual: 23.3.12, status: affected, version: 23.0.0, versionType: maven
lessThanOrEqual: 24.0.5, status: affected, version: 24.0.0, versionType: maven
lessThanOrEqual: 24.1.0.beta1, status: affected, version: 24.1.0.alpha1, versionType: maven
}
{
defaultStatus: unaffected
product: flow-server
repo: https://github.com/vaadin/flow
vendor: vaadin
versions:
lessThanOrEqual: 24.0.0.beta1, status: affected, version: 1.0.0, versionType: maven
lessThanOrEqual: 2.8.9, status: affected, version: 1.1.0, versionType: maven
lessThanOrEqual: 9.1.0, status: affected, version: 3.3.0, versionType: maven
lessThanOrEqual: 23.3.10, status: affected, version: 23.0.0, versionType: maven
lessThanOrEqual: 24.0.7, status: affected, version: 24.0.0, versionType: maven
lessThanOrEqual: 24.1.0.beta1, status: affected, version: 24.1.0.alpha1, versionType: maven
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL