CVE-2022-29567

Possible information disclosure inside TreeGrid component with default data provider

State: Published
Severity: 5.7 Medium
Published: May 24, 2022
Updated: Sep 14, 2026
Reserved: Apr 21, 2022

Description

The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.

Scores

CVSS	Score	Vector	Source
3.1	5.7 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N	Vaadin

Weaknesses

CWE-200 Information Exposure

Affected Products

Product	Versions
vaadinVaadin	14.8.5 through 14.8.9Affected 22.0.6 through 22.0.14Affected 23.0.0.beta2 through 23.0.8Affected 23.1.0.alpha1 to before 23.1.0.beta1Affected
vaadin-grid-flowVaadin	14.8.5 through 14.8.9Affected 22.0.6 through 22.0.14Affected 23.0.0.beta2 through 23.0.8Affected 23.1.0.alpha1 to before 23.1.0.beta1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.