What happened
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.
Affected versions
vaadin: 10.0.0 through 10.0.23 (maven); 11.0.0 through 14.10.1 (maven); 15.0.0 through 22.0.28 (maven); 23.0.0 through 23.3.13 (maven); 24.0.0 through 24.0.6 (maven); 24.1.0.alpha1 through 24.1.0.rc2 (maven); 1.0.0 through 1.0.20 (maven); 1.1.0 through 2.9.2 (maven); 3.0.0 through 9.1.1 (maven); 23.0.0 through 23.3.12 (maven); 24.0.0 through 24.0.8 (maven); 24.1.0.alpha1 through 24.1.0.rc3 (maven) Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
No public PoC reference has passed the current publication threshold.