{"id":"CVE-2022-29567","summary":"Possible information disclosure inside TreeGrid component with default data provider","details":"The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.","aliases":["GHSA-qfr3-323w-qv27"],"modified":"2026-09-16T08:29:32.204082Z","published":"2022-05-24T14:20:19.452Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29567.json","cna_assigner":"Vaadin","cwe_ids":["CWE-200"]},"references":[{"type":"WEB","url":"https://repo.maven.apache.org/maven2"},{"type":"WEB","url":"https://vaadin.com/security/cve-2022-29567"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29567.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29567"},{"type":"FIX","url":"https://github.com/vaadin/flow-components/pull/3046"},{"type":"PACKAGE","url":"https://github.com/vaadin/flow-components"},{"type":"PACKAGE","url":"https://github.com/vaadin/platform"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vaadin/flow-components","events":[{"introduced":"00014f67045798c8575939bdb1c16d3727a1ed55"},{"last_affected":"86dd569d5e95697a10af1d501d7a320b7407d158"},{"introduced":"d68c131ef0f4e7e4e32f04be506e1246a8bc8190"},{"last_affected":"e6f5e9c569ae4f75d15e324078750001966b0315"},{"introduced":"3485318f0ad9cb9af4ee7472b989283fc704585d"},{"last_affected":"498d3a421b7e7cb43c349438405fb75bf3b73e8b"},{"introduced":"e0c963da12dd5c30e5e96ea48c7330b515aa62ed"},{"fixed":"8fe08611e304779df01ecd6306d478a9c0edced0"}],"database_specific":{"extracted_events":[{"introduced":"14.8.5"},{"last_affected":"14.8.9"},{"introduced":"22.0.6"},{"last_affected":"22.0.14"},{"introduced":"23.0.0.beta2"},{"last_affected":"23.0.8"},{"introduced":"23.1.0.alpha1"},{"fixed":"23.1.0.beta1"}],"source":"AFFECTED_FIELD"}},{"type":"GIT","repo":"https://github.com/vaadin/platform","events":[{"introduced":"bc402cf899942f74a62993f8e612af466bee056f"},{"last_affected":"807b2087b918f43525d5bd443e3608bf86583322"},{"introduced":"913a1d49e922efad85dbef6888b18bc011dc5650"},{"last_affected":"f2d230ec7a1ba939c7230723fac1089fad2b2006"},{"introduced":"5430e0a3e45842600792de19a6a6784761c96da4"},{"last_affected":"ab17ce191141b2f8bb69e6a7cf4a1db075904c4f"},{"introduced":"0b73a5a157b036577d09a9f65559714246ab6e6e"},{"last_affected":"1c505b3f9875b925113bed183136d8a357651e34"}],"database_specific":{"cpe":["cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:-:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:beta4:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.1.0:alpha1:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.1.0:alpha2:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.1.0:alpha3:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.1.0:alpha4:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.8.5"},{"last_affected":"14.8.9"},{"introduced":"22.0.6"},{"last_affected":"22.0.15"},{"introduced":"23.0.1"},{"last_affected":"23.0.8"},{"introduced":"23.0.0-NA"},{"last_affected":"23.0.0-NA"},{"introduced":"23.0.0-beta2"},{"last_affected":"23.0.0-beta2"},{"introduced":"23.0.0-beta3"},{"last_affected":"23.0.0-beta3"},{"introduced":"23.0.0-beta4"},{"last_affected":"23.0.0-beta4"},{"introduced":"23.0.0-rc1"},{"last_affected":"23.0.0-rc1"},{"introduced":"23.1.0-alpha1"},{"last_affected":"23.1.0-alpha1"},{"introduced":"23.1.0-alpha2"},{"last_affected":"23.1.0-alpha2"},{"introduced":"23.1.0-alpha3"},{"last_affected":"23.1.0-alpha3"},{"introduced":"23.1.0-alpha4"},{"last_affected":"23.1.0-alpha4"}],"source":["CPE_RANGE","CPE_STRING"]}},{"type":"GIT","repo":"https://github.com/vaadin/vaadin","events":[{"introduced":"acb11dbc88fa66aaca85c84bdb9158338b0141ca"},{"last_affected":"19e688830a7b47ff74857555288733c9df8cef50"},{"introduced":"9e1bcd8531e89bac4f2c23e534e8d7235de05580"},{"last_affected":"0d051d2c8b12fd24f23d0849ef6eef777f6d3fc0"},{"introduced":"af8d02bb26203d51353e6d81c7ced532bf88bf68"},{"last_affected":"d8f21a82bf0d77712fd5632d45472daf02302ba0"},{"introduced":"e107b1973a390cafc749031e033f37de7b9a4a1f"},{"last_affected":"71398ebce2ffe466589ce3e6789f1cea6781931f"}],"database_specific":{"extracted_events":[{"introduced":"14.8.5"},{"last_affected":"14.8.9"},{"introduced":"22.0.6"},{"last_affected":"22.0.15"},{"introduced":"23.0.1"},{"last_affected":"23.0.8"},{"introduced":"23.0.0-NA"},{"last_affected":"23.0.0-NA"},{"introduced":"23.0.0-beta2"},{"last_affected":"23.0.0-beta2"},{"introduced":"23.0.0-beta3"},{"last_affected":"23.0.0-beta3"},{"introduced":"23.0.0-beta4"},{"last_affected":"23.0.0-beta4"},{"introduced":"23.0.0-rc1"},{"last_affected":"23.0.0-rc1"},{"introduced":"23.1.0-alpha1"},{"last_affected":"23.1.0-alpha1"},{"introduced":"23.1.0-alpha2"},{"last_affected":"23.1.0-alpha2"},{"introduced":"23.1.0-alpha3"},{"last_affected":"23.1.0-alpha3"},{"introduced":"23.1.0-alpha4"},{"last_affected":"23.1.0-alpha4"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:-:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:beta4:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.1.0:alpha1:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.1.0:alpha2:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.1.0:alpha3:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.1.0:alpha4:*:*:*:*:*:*"]}}],"versions":["23.0.0-NA","23.0.0-beta2","23.0.0-beta3","23.0.0-beta4","23.0.0-rc1","23.1.0-alpha1","23.1.0-alpha2","23.1.0-alpha3","23.1.0-alpha4","23.0.8","23.1.0.alpha4","14.8.9","14.8.8","23.0.7","22.0.14","23.1.0.alpha3","23.0.6","22.0.13","23.1.0.alpha2","23.0.5","22.0.12","23.0.4","23.1.0.alpha1","14.8.7","14.8.6","23.0.3","22.0.11","22.0.10","23.0.2","14.8.5","23.0.1","22.0.9","22.0.8","23.0.0","22.0.7","22.0.6","23.0.0.rc1","23.0.0.beta4","23.0.0.beta3","23.0.0.beta2","22.0.15","v22.0.15","v23.0.8","v14.8.9","v22.0.14","v23.1.0-alpha4","v23.0.7","v23.1.0-alpha3","v23.0.6","v14.8.8","v22.0.13","v23.1.0-alpha2","v23.0.5","v23.1.0-alpha1","v23.0.4","v14.8.7","v22.0.12","v23.0.0","v23.0.3","v22.0.11","v14.8.6","v23.0.2","v22.0.10","v23.0.1","v22.0.9","v14.8.5","v22.0.8","v22.0.7","v22.0.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29567.json","vanir_signatures_modified":"2026-09-16T08:29:32Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8fe08611e304779df01ecd6306d478a9c0edced0","target":{"file":"vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/treegrid/TreeGrid.java"},"deprecated":false,"digest":{"line_hashes":["227253610474657420000658638497856832181","325547998130023685155870179560616361283","264549496675469912738344520375456639123","168441416726914295460019155720942763198","303439880652311329003262891667535971196","246815559709441532363689912362551173558","302377633647492389705157050971342380269","300218840941545479939337541484526173966","68287953031691458000546692801069623235","263065027422628275750912490098625604625","183802768986209993314959803271964339569","208038595260503375500860228201491984098","216262777619120865416968809269528036178","314459709021664788149524600442790668315","232857988567520515487732049155279170023","184711204978225754154429885156385223866","277762406796287067185157291016056249236"],"threshold":0.9},"id":"CVE-2022-29567-70b2cbe4"},{"digest":{"function_hash":"250155782693343714630631065357399756347","length":622},"id":"CVE-2022-29567-722384cf","signature_type":"Function","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8fe08611e304779df01ecd6306d478a9c0edced0","target":{"file":"vaadin-grid-flow-parent/vaadin-grid-flow-integration-tests/src/main/java/com/vaadin/flow/component/treegrid/it/TreeGridPreloadPage.java","function":"setDataProvider"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8fe08611e304779df01ecd6306d478a9c0edced0","target":{"function":"TreeGridPreloadPage","file":"vaadin-grid-flow-parent/vaadin-grid-flow-integration-tests/src/main/java/com/vaadin/flow/component/treegrid/it/TreeGridPreloadPage.java"},"deprecated":false,"digest":{"function_hash":"188402487619299096108953219894411615845","length":1750},"id":"CVE-2022-29567-8c2b5ce7","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["274108684783086354814437216584552015536","277539696549176848440428307085227334616","156886772506292107536391189984379743834","233211424031949977857866557792026527220","335307821439601120976978490567030304348","268566790089202053953879739342540544168","239955306471911677062382327512418465971","45688970776578600652230586957721116862"],"threshold":0.9},"id":"CVE-2022-29567-fb967937","signature_type":"Line","signature_version":"v1","source":"https://github.com/vaadin/flow-components/commit/8fe08611e304779df01ecd6306d478a9c0edced0","target":{"file":"vaadin-grid-flow-parent/vaadin-grid-flow-integration-tests/src/main/java/com/vaadin/flow/component/treegrid/it/TreeGridPreloadPage.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"}]}