description: Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.
problem types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
defaultStatus: unaffected
product: vaadin
vendor: vaadin
versions:
lessThanOrEqual: 10.0.23, status: affected, version: 10.0.0, versionType: maven
lessThanOrEqual: 14.10.1, status: affected, version: 11.0.0, versionType: maven
lessThanOrEqual: 22.0.8, status: affected, version: 15.0.0, versionType: maven
lessThanOrEqual: 23.3.13, status: affected, version: 23.0.0, versionType: maven
lessThanOrEqual: 24.0.6, status: affected, version: 24.0.0, versionType: maven
lessThanOrEqual: 24.1.0.rc2, status: affected, version: 24.1.0.alpha1, versionType: maven
}
{
defaultStatus: unaffected
product: flow-server
vendor: flow
versions:
lessThanOrEqual: 1.0.20, status: affected, version: 1.0.0, versionType: maven
lessThanOrEqual: 2.9.2, status: affected, version: 1.1.0, versionType: maven
lessThanOrEqual: 9.1.1, status: affected, version: 3.0.0, versionType: maven
lessThanOrEqual: 23.3.12, status: affected, version: 23.0.0, versionType: maven
lessThanOrEqual: 24.0.8, status: affected, version: 24.0.0, versionType: maven
lessThanOrEqual: 24.1.0.rc3, status: affected, version: 24.1.0.alpha1, versionType: maven
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL