Description
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.
Remediation
References
https://github.com/vaadin/flow/pull/16935
https://vaadin.com/security/cve-2023-25500
Related Vulnerabilities
CVE-2018-8014 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2017-12974 Vulnerability in maven package com.nimbusds:nimbus-jose-jwt
CVE-2013-4942 Vulnerability in npm package yui
CVE-2019-17195 Vulnerability in maven package com.nimbusds:nimbus-jose-jwt
CVE-2022-24759 Vulnerability in npm package @chainsafe/libp2p-noise