CVE-2022-29567 MEDIUM

CVE-2022-29567: Possible information disclosure inside TreeGrid component with default data provider

Vendor Vaadin
Product vaadin
Weakness CWE-200 · Info exposure
Published May 24, 2022
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

5.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.

Key dates

02Disclosure timeline

May 24, 2022 CVE published
September 16, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-20164 Sensitive Information Disclosure through Improper Access Control in Splunk Enterprise CVE-2026-5847 code-projects Movie Ticketing System SQL Database Backup File moviedb.sql information disclosure CVE-2024-25118 Information Disclosure of Hashed Passwords in TYPO3 Backend Forms CVE-2022-39029 Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -1 CVE-2026-27796 Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak)