Description
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.
Remediation
References
https://github.com/vaadin/flow/pull/16935
https://vaadin.com/security/cve-2023-25500
Related Vulnerabilities
CVE-2017-16116 Vulnerability in maven package org.webjars.npm:string
CVE-2020-7680 Vulnerability in npm package docsify
CVE-2017-20160 Vulnerability in npm package express-param
CVE-2018-1000129 Vulnerability in maven package org.jolokia:jolokia-core
CVE-2018-16131 Vulnerability in maven package com.typesafe.akka:akka-http-core_2.11