CVE-2022-29567
Possible information disclosure inside TreeGrid component with default data provider
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Possible information disclosure inside TreeGrid component with default data provider
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
- Record
CVE-2022-29567- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2022-4962
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
- Record
EUVD-2022-4962- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qfr3-323w-qv27
Possible information disclosure inside TreeGrid component with default data provider
Description
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
- Record
GHSA-qfr3-323w-qv27- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
- Record
CVE-2022-29567- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Possible information disclosure inside TreeGrid component with default data provider
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
- Record
CVE-2022-29567- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-qfr3-323w-qv27
Possible information disclosure inside TreeGrid component with default data provider
Description
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
- Record
GHSA-qfr3-323w-qv27- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.vaadin:vaadinMaven |
14.8.5 up to 14.8.10 | 14.8.10 |
com.vaadin:vaadinMaven |
22.0.6 up to 22.0.15 | 22.0.15 |
com.vaadin:vaadinMaven |
23.0.0 up to 23.0.9 | 23.0.9 |
com.vaadin:vaadin-grid-flowMaven |
14.8.5 up to 14.8.10 | 14.8.10 |
com.vaadin:vaadin-grid-flowMaven |
22.0.6 up to 22.0.15 | 22.0.15 |
com.vaadin:vaadin-grid-flowMaven |
23.0.0.beta2 up to 23.0.9 | 23.0.9 |
com.vaadin:vaadinMaven |
14.8.5 up to 14.8.10, plus listed versions 14.8.614.8.714.8.814.8.9 |
14.8.10 |
com.vaadin:vaadinMaven |
22.0.6 up to 22.0.15, plus listed versions 22.0.1022.0.1122.0.1222.0.1322.0.1422.0.722.0.822.0.9 |
22.0.15 |
com.vaadin:vaadinMaven |
23.0.0 up to 23.0.9, plus listed versions 23.0.123.0.223.0.323.0.423.0.523.0.623.0.723.0.8 |
23.0.9 |
com.vaadin:vaadin-grid-flowMaven |
14.8.5 up to 14.8.10, plus listed versions 14.8.614.8.714.8.814.8.9 |
14.8.10 |
com.vaadin:vaadin-grid-flowMaven |
22.0.6 up to 22.0.15, plus listed versions 22.0.1022.0.1122.0.1222.0.1322.0.1422.0.722.0.822.0.9 |
22.0.15 |
com.vaadin:vaadin-grid-flowMaven |
23.0.0.beta2 up to 23.0.9, plus listed versions 23.0.023.0.123.0.223.0.323.0.4 Show 4 moreShow less23.0.523.0.623.0.723.0.8 |
23.0.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-29567 is a medium vulnerability (CVSS 5.7) in Vaadin, published May 24, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 63rd percentile. Fixed in com.vaadin:vaadin 14.8.10.
References
vaadin.com/security/cve-2022-29567
github.com/vaadin/flow-components/pull/3046
nvd.nist.gov/vuln/detail/CVE-2022-29567
repo.maven.apache.org/maven2