Description
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.
Remediation
References
https://github.com/vaadin/flow/pull/16935
https://vaadin.com/security/cve-2023-25500
Related Vulnerabilities
CVE-2021-23341 Vulnerability in maven package org.webjars.npm:prismjs
CVE-2023-36470 Vulnerability in maven package org.xwiki.platform:xwiki-platform-icon-default
CVE-2014-2063 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2011-1088 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2023-6293 Vulnerability in npm package sequelize-typescript