CVE-2023-25499
Possible information disclosure in non visible components
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Possible information disclosure in non visible components
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.
- Record
CVE-2023-25499- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2023-1700
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.
- Record
EUVD-2023-1700- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5f9v-mv5g-jh5q
Vaadin vulnerable to possible information disclosure in non visible components.
Description
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.
- Record
GHSA-5f9v-mv5g-jh5q- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-201
- Updated
- 2026-11-02
NVD
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.
- Record
CVE-2023-25499- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Possible information disclosure in non visible components
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.
- Record
CVE-2023-25499- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-5f9v-mv5g-jh5q
Vaadin vulnerable to possible information disclosure in non visible components.
Description
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.
- Record
GHSA-5f9v-mv5g-jh5q- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-201
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.vaadin:vaadinMaven |
10.0.0 up to 10.0.23 | 10.0.23 |
com.vaadin:vaadinMaven |
11.0.0 up to 14.10.1 | 14.10.1 |
com.vaadin:vaadinMaven |
23.0.0 up to 23.3.13 | 23.3.13 |
com.vaadin:vaadinMaven |
24.0.0 up to 24.0.6 | 24.0.6 |
com.vaadin:vaadinMaven |
24.1.0.alpha1 up to 24.1.0 | 24.1.0 |
com.vaadin:flow-serverMaven |
1.0.0 up to 1.0.20 | 1.0.20 |
com.vaadin:flow-serverMaven |
1.1.0 up to 2.8.10 | 2.8.10 |
com.vaadin:flow-serverMaven |
3.0.0 up to 9.1.1 | 9.1.1 |
com.vaadin:flow-serverMaven |
23.0.0 up to 23.3.11 | 23.3.11 |
com.vaadin:flow-serverMaven |
24.0.0 up to 24.0.8 | 24.0.8 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
com.vaadin:flow-serverMaven |
24.1.0.alpha1 up to 24.1.0 | 24.1.0 |
com.vaadin:vaadinMaven |
10.0.0 up to 10.0.23, plus listed versions 10.0.110.0.1010.0.1110.0.1210.0.13 Show 17 moreShow less10.0.1410.0.1510.0.1610.0.1710.0.1810.0.1910.0.210.0.2010.0.2110.0.2210.0.310.0.410.0.510.0.610.0.710.0.810.0.9 |
10.0.23 |
com.vaadin:vaadinMaven |
11.0.0 up to 14.10.1, plus listed versions 11.0.111.0.211.0.311.0.412.0.0 Show 45 moreShow less12.0.112.0.212.0.312.0.412.0.512.0.612.0.713.0.013.0.113.0.1013.0.1113.0.1213.0.1313.0.213.0.313.0.413.0.513.0.613.0.713.0.813.0.914.0.014.0.114.0.1014.0.1114.0.1214.0.1314.0.1414.0.1514.0.214.0.314.0.414.0.514.0.614.0.714.0.814.0.914.1.014.1.114.1.1614.1.1714.1.1814.1.1914.1.214.1.20 |
14.10.1 |
com.vaadin:vaadinMaven |
23.0.0 up to 23.3.13, plus listed versions 23.0.123.0.1023.0.1123.0.1223.0.13 Show 45 moreShow less23.0.1423.0.1523.0.1623.0.223.0.323.0.423.0.523.0.623.0.723.0.823.0.923.1.023.1.123.1.1023.1.1123.1.1223.1.1323.1.1423.1.1523.1.1623.1.1723.1.223.1.323.1.423.1.623.1.723.1.823.1.923.2.023.2.123.2.1023.2.1123.2.1223.2.1323.2.1423.2.1523.2.1623.2.1723.2.223.2.323.2.423.2.523.2.623.2.723.2.8 |
23.3.13 |
com.vaadin:vaadinMaven |
24.0.0 up to 24.0.6, plus listed versions 24.0.124.0.224.0.324.0.424.0.5 |
24.0.6 |
com.vaadin:flow-serverMaven |
1.0.0 up to 1.0.20, plus listed versions 1.0.11.0.101.0.111.0.121.0.13 Show 14 moreShow less1.0.141.0.151.0.161.0.171.0.181.0.191.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.9 |
1.0.20 |
com.vaadin:flow-serverMaven |
1.1.0 up to 2.8.10, plus listed versions 1.2.01.2.11.2.21.2.31.2.4 Show 45 moreShow less1.2.51.3.01.4.01.4.11.4.21.4.31.4.41.4.51.4.61.4.71.4.82.0.02.0.12.0.102.0.112.0.122.0.132.0.142.0.152.0.162.0.172.0.182.0.192.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.1.02.1.0.beta22.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0.alpha112.2.1 |
2.8.10 |
com.vaadin:flow-serverMaven |
3.0.0 up to 9.1.1, plus listed versions 3.0.13.0.23.0.33.0.43.0.5 Show 45 moreShow less3.0.63.0.73.1.03.1.13.1.23.1.33.1.53.1.63.1.74.0.04.0.14.0.24.0.34.0.44.0.54.0.64.0.74.0.85.0.05.0.15.0.25.0.35.0.46.0.06.0.16.0.106.0.26.0.36.0.46.0.56.0.66.0.76.0.86.0.97.0.07.0.17.0.27.0.37.0.47.0.57.0.67.0.77.0.87.0.98.0.0 |
9.1.1 |
com.vaadin:flow-serverMaven |
23.0.0 up to 23.3.11, plus listed versions 23.0.123.0.1023.0.1123.0.1223.0.13 Show 45 moreShow less23.0.1423.0.223.0.323.0.423.0.523.0.623.0.723.0.823.0.923.1.023.1.123.1.1023.1.1123.1.1223.1.223.1.323.1.423.1.523.1.623.1.723.1.823.1.923.2.023.2.123.2.1023.2.1123.2.223.2.323.2.423.2.523.2.623.2.723.2.823.2.923.3.023.3.123.3.1023.3.223.3.323.3.423.3.523.3.623.3.723.3.823.3.9 |
23.3.11 |
com.vaadin:flow-serverMaven |
24.0.0 up to 24.0.8, plus listed versions 24.0.124.0.224.0.324.0.424.0.524.0.624.0.7 |
24.0.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-25499 is a medium vulnerability (CVSS 5.7) in Vaadin, published June 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 47th percentile. Fixed in com.vaadin:vaadin 10.0.23.
References
vaadin.com/security/CVE-2023-25499
github.com/vaadin/flow/pull/15885
nvd.nist.gov/vuln/detail/CVE-2023-25499
Left out here: 208 versions. The JSON record has them.