Description
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.
Remediation
References
https://github.com/vaadin/flow/pull/16935
https://vaadin.com/security/cve-2023-25500
Related Vulnerabilities
CVE-2011-5062 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2018-3721 Vulnerability in maven package org.webjars.bower:lodash
CVE-2022-26183 Vulnerability in npm package pnpm
CVE-2013-4310 Vulnerability in maven package org.apache.struts:struts2-core
CVE-2022-39312 Vulnerability in maven package io.dataease:dataease-plugin-common