{"id":"GHSA-qfr3-323w-qv27","summary":"Possible information disclosure inside TreeGrid component with default data provider","details":"### Description\n\nThe default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.\n","aliases":["CVE-2022-29567"],"modified":"2024-05-15T06:31:57.764298Z","published":"2022-05-25T22:40:03Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2022-05-25T22:40:03Z","nvd_published_at":"2022-05-24T15:15:00Z","cwe_ids":["CWE-200"]},"references":[{"type":"WEB","url":"https://github.com/vaadin/platform/security/advisories/GHSA-qfr3-323w-qv27"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29567"},{"type":"WEB","url":"https://github.com/vaadin/flow-components/pull/3046"},{"type":"PACKAGE","url":"https://github.com/vaadin/platform"},{"type":"WEB","url":"https://vaadin.com/security/cve-2022-29567"}],"affected":[{"package":{"name":"com.vaadin:vaadin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.8.5"},{"fixed":"14.8.10"}]}],"versions":["14.8.5","14.8.6","14.8.7","14.8.8","14.8.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qfr3-323w-qv27/GHSA-qfr3-323w-qv27.json"}},{"package":{"name":"com.vaadin:vaadin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.0.6"},{"fixed":"22.0.15"}]}],"versions":["22.0.10","22.0.11","22.0.12","22.0.13","22.0.14","22.0.6","22.0.7","22.0.8","22.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qfr3-323w-qv27/GHSA-qfr3-323w-qv27.json"}},{"package":{"name":"com.vaadin:vaadin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.0"},{"fixed":"23.0.9"}]}],"versions":["23.0.0","23.0.1","23.0.2","23.0.3","23.0.4","23.0.5","23.0.6","23.0.7","23.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qfr3-323w-qv27/GHSA-qfr3-323w-qv27.json"}},{"package":{"name":"com.vaadin:vaadin-grid-flow","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin-grid-flow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.8.5"},{"fixed":"14.8.10"}]}],"versions":["14.8.5","14.8.6","14.8.7","14.8.8","14.8.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qfr3-323w-qv27/GHSA-qfr3-323w-qv27.json"}},{"package":{"name":"com.vaadin:vaadin-grid-flow","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin-grid-flow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.0.6"},{"fixed":"22.0.15"}]}],"versions":["22.0.10","22.0.11","22.0.12","22.0.13","22.0.14","22.0.6","22.0.7","22.0.8","22.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qfr3-323w-qv27/GHSA-qfr3-323w-qv27.json"}},{"package":{"name":"com.vaadin:vaadin-grid-flow","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin-grid-flow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.0.beta2"},{"fixed":"23.0.9"}]}],"versions":["23.0.0","23.0.1","23.0.2","23.0.3","23.0.4","23.0.5","23.0.6","23.0.7","23.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qfr3-323w-qv27/GHSA-qfr3-323w-qv27.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"}]}