nvd-json-data-feeds/CVE-2022/CVE-2022-295xx/CVE-2022-29567.json

{
  "id": "CVE-2022-29567",
  "sourceIdentifier": "security@vaadin.com",
  "published": "2022-05-24T15:15:08.220",
  "lastModified": "2022-06-07T16:59:32.253",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side."
    },
    {
      "lang": "es",
      "value": "La configuraci\u00f3n por defecto de un componente TreeGrid usa Object::toString como clave en la comunicaci\u00f3n con el cliente y el servidor en Vaadin versiones 14.8.5 hasta 14.8.9, 22.0.6 hasta 22.0.14, 23.0.0.beta2 hasta 23.0.8 y 23.1.0.alpha1 hasta 23.1.0.alpha4, resultando en una potencial divulgaci\u00f3n de informaci\u00f3n de valores que no deber\u00edan estar disponibles en el lado del cliente"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      },
      {
        "source": "security@vaadin.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.7,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 3.6
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "source": "security@vaadin.com",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "14.8.5",
              "versionEndIncluding": "14.8.9",
              "matchCriteriaId": "0579A51E-A3E6-4380-A378-55C53EC3768D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "22.0.6",
              "versionEndIncluding": "22.0.15",
              "matchCriteriaId": "3A7479D6-D6DF-4BE2-AD6C-F92DC502C6B3"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "23.0.1",
              "versionEndIncluding": "23.0.8",
              "matchCriteriaId": "4C5BD69D-AF05-4A3E-AB1C-B3B3D1721E0E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vaadin:vaadin:23.0.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "9E4809E3-6B53-484E-BE86-BB554D346C01"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vaadin:vaadin:23.0.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "F50971D5-297E-4558-9BE5-AD7378A4215F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vaadin:vaadin:23.0.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "E561C638-33CB-4C1C-9A0B-FC590993C59F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vaadin:vaadin:23.0.0:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "F992E61E-EC84-44E9-90CE-113EF2B1EB05"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vaadin:vaadin:23.0.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "F4382528-7D82-4339-8615-891C93D749C4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha1:*:*:*:*:*:*",
              "matchCriteriaId": "778333E4-27C5-4EA3-8EF8-48774CE67188"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha2:*:*:*:*:*:*",
              "matchCriteriaId": "A84E4454-773E-4735-B5D4-9F2E6537B8B1"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha3:*:*:*:*:*:*",
              "matchCriteriaId": "9544B2F5-C913-4ECE-8028-8BFBFD36A2EB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha4:*:*:*:*:*:*",
              "matchCriteriaId": "312D297B-ACBD-4764-80AD-5AB042DCE01D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/vaadin/flow-components/pull/3046",
      "source": "security@vaadin.com",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://vaadin.com/security/cve-2022-29567",
      "source": "security@vaadin.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ]
    }
  ]
}