CVE-2022-29567

Katalog CVE

CVSS 7.5 · High EPSS 1,0%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada vaadin. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.

Rincian

Terbit di NVD

24 Mei 2022

Terakhir diubah

14 September 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 61,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vaadin.com/security/cve-2022-29567 issue tracking · advisory vendor
• https://github.com/vaadin/flow-components/pull/3046 issue tracking · patch · advisory pihak ketiga