CVE-2022-29567

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-29567
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29567.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-29567
Aliases
Published
2022-05-24T14:20:19Z
Modified
2026-10-22T07:43:48Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Possible information disclosure inside TreeGrid component with default data provider
Details

The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.

Database specific 
{
    "cna_assigner":  "Vaadin",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29567.json"
}
References

Affected packages

Git / github.com/vaadin/flow-components

Affected ranges

Type
GIT
Repo
https://github.com/vaadin/flow-components
Events
Introduced
00014f67045798c8575939bdb1c16d3727a1ed55
Last Affected
86dd569d5e95697a10af1d501d7a320b7407d158
Introduced
d68c131ef0f4e7e4e32f04be506e1246a8bc8190
Last Affected
e6f5e9c569ae4f75d15e324078750001966b0315
Introduced
3485318f0ad9cb9af4ee7472b989283fc704585d
Last Affected
498d3a421b7e7cb43c349438405fb75bf3b73e8b
Introduced
e0c963da12dd5c30e5e96ea48c7330b515aa62ed
Fixed
8fe08611e304779df01ecd6306d478a9c0edced0
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "14.8.5"
                },
                {
                    "last_affected":  "14.8.9"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "22.0.6"
                },
                {
                    "last_affected":  "22.0.14"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "23.0.0.beta2"
                },
                {
                    "last_affected":  "23.0.8"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "23.1.0.alpha1"
                },
                {
                    "fixed":  "23.1.0.beta1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

14.*
14.8.5
14.8.6
14.8.7
14.8.8
14.8.9
22.*
22.0.10
22.0.11
22.0.12
22.0.13
22.0.14
22.0.6
22.0.7
22.0.8
22.0.9
23.*
23.0.0
23.0.0-NA
23.0.0-beta2
23.0.0-beta3
23.0.0-beta4
23.0.0-rc1
23.0.0.beta2
23.0.0.beta3
23.0.0.beta4
23.0.0.rc1
23.0.1
23.0.2
23.0.3
23.0.4
23.0.5
23.0.6
23.0.7
23.0.8
23.1.0-alpha1
23.1.0-alpha2
23.1.0-alpha3
23.1.0-alpha4
23.1.0.alpha1
23.1.0.alpha2
23.1.0.alpha3
23.1.0.alpha4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29567.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "227253610474657420000658638497856832181",
                "325547998130023685155870179560616361283",
                "264549496675469912738344520375456639123",
                "168441416726914295460019155720942763198",
                "303439880652311329003262891667535971196",
                "246815559709441532363689912362551173558",
                "302377633647492389705157050971342380269",
                "300218840941545479939337541484526173966",
                "68287953031691458000546692801069623235",
                "263065027422628275750912490098625604625",
                "183802768986209993314959803271964339569",
                "208038595260503375500860228201491984098",
                "216262777619120865416968809269528036178",
                "314459709021664788149524600442790668315",
                "232857988567520515487732049155279170023",
                "184711204978225754154429885156385223866",
                "277762406796287067185157291016056249236"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-29567-70b2cbe4",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/vaadin/flow-components/commit/8fe08611e304779df01ecd6306d478a9c0edced0",
        "target":  {
            "file":  "vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/treegrid/TreeGrid.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "250155782693343714630631065357399756347",
            "length":  622
        },
        "id":  "CVE-2022-29567-722384cf",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/vaadin/flow-components/commit/8fe08611e304779df01ecd6306d478a9c0edced0",
        "target":  {
            "file":  "vaadin-grid-flow-parent/vaadin-grid-flow-integration-tests/src/main/java/com/vaadin/flow/component/treegrid/it/TreeGridPreloadPage.java",
            "function":  "setDataProvider"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "188402487619299096108953219894411615845",
            "length":  1750
        },
        "id":  "CVE-2022-29567-8c2b5ce7",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/vaadin/flow-components/commit/8fe08611e304779df01ecd6306d478a9c0edced0",
        "target":  {
            "file":  "vaadin-grid-flow-parent/vaadin-grid-flow-integration-tests/src/main/java/com/vaadin/flow/component/treegrid/it/TreeGridPreloadPage.java",
            "function":  "TreeGridPreloadPage"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "274108684783086354814437216584552015536",
                "277539696549176848440428307085227334616",
                "156886772506292107536391189984379743834",
                "233211424031949977857866557792026527220",
                "335307821439601120976978490567030304348",
                "268566790089202053953879739342540544168",
                "239955306471911677062382327512418465971",
                "45688970776578600652230586957721116862"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-29567-fb967937",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/vaadin/flow-components/commit/8fe08611e304779df01ecd6306d478a9c0edced0",
        "target":  {
            "file":  "vaadin-grid-flow-parent/vaadin-grid-flow-integration-tests/src/main/java/com/vaadin/flow/component/treegrid/it/TreeGridPreloadPage.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-22T07:43:48Z"