CVE-2022-29567

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-29567
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29567.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-29567
Aliases
Published
2022-05-24T14:20:19Z
Modified
2026-09-16T08:29:32Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Possible information disclosure inside TreeGrid component with default data provider
Details

The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.

Database specific 
{
    "cna_assigner":  "Vaadin",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29567.json"
}
References

Affected packages

Git / github.com/vaadin/flow-components

Affected ranges

Type
GIT
Repo
https://github.com/vaadin/flow-components
Events
Introduced
00014f67045798c8575939bdb1c16d3727a1ed55
Last Affected
86dd569d5e95697a10af1d501d7a320b7407d158
Introduced
d68c131ef0f4e7e4e32f04be506e1246a8bc8190
Last Affected
e6f5e9c569ae4f75d15e324078750001966b0315
Introduced
3485318f0ad9cb9af4ee7472b989283fc704585d
Last Affected
498d3a421b7e7cb43c349438405fb75bf3b73e8b
Introduced
e0c963da12dd5c30e5e96ea48c7330b515aa62ed
Fixed
8fe08611e304779df01ecd6306d478a9c0edced0
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "14.8.5"
        },
        {
            "last_affected":  "14.8.9"
        },
        {
            "introduced":  "22.0.6"
        },
        {
            "last_affected":  "22.0.14"
        },
        {
            "introduced":  "23.0.0.beta2"
        },
        {
            "last_affected":  "23.0.8"
        },
        {
            "introduced":  "23.1.0.alpha1"
        },
        {
            "fixed":  "23.1.0.beta1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}
Type
GIT
Repo
https://github.com/vaadin/platform
Events
Introduced
bc402cf899942f74a62993f8e612af466bee056f
Last Affected
807b2087b918f43525d5bd443e3608bf86583322
Introduced
913a1d49e922efad85dbef6888b18bc011dc5650
Last Affected
f2d230ec7a1ba939c7230723fac1089fad2b2006
Introduced
5430e0a3e45842600792de19a6a6784761c96da4
Last Affected
ab17ce191141b2f8bb69e6a7cf4a1db075904c4f
Introduced
0b73a5a157b036577d09a9f65559714246ab6e6e
Last Affected
1c505b3f9875b925113bed183136d8a357651e34
Database specific
Show details 
{
    "cpe":  [
        "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:beta2:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:beta3:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:beta4:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha1:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha2:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha3:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha4:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "14.8.5"
        },
        {
            "last_affected":  "14.8.9"
        },
        {
            "introduced":  "22.0.6"
        },
        {
            "last_affected":  "22.0.15"
        },
        {
            "introduced":  "23.0.1"
        },
        {
            "last_affected":  "23.0.8"
        },
        {
            "introduced":  "23.0.0-NA"
        },
        {
            "last_affected":  "23.0.0-NA"
        },
        {
            "introduced":  "23.0.0-beta2"
        },
        {
            "last_affected":  "23.0.0-beta2"
        },
        {
            "introduced":  "23.0.0-beta3"
        },
        {
            "last_affected":  "23.0.0-beta3"
        },
        {
            "introduced":  "23.0.0-beta4"
        },
        {
            "last_affected":  "23.0.0-beta4"
        },
        {
            "introduced":  "23.0.0-rc1"
        },
        {
            "last_affected":  "23.0.0-rc1"
        },
        {
            "introduced":  "23.1.0-alpha1"
        },
        {
            "last_affected":  "23.1.0-alpha1"
        },
        {
            "introduced":  "23.1.0-alpha2"
        },
        {
            "last_affected":  "23.1.0-alpha2"
        },
        {
            "introduced":  "23.1.0-alpha3"
        },
        {
            "last_affected":  "23.1.0-alpha3"
        },
        {
            "introduced":  "23.1.0-alpha4"
        },
        {
            "last_affected":  "23.1.0-alpha4"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}
Type
GIT
Repo
https://github.com/vaadin/vaadin
Events
Introduced
acb11dbc88fa66aaca85c84bdb9158338b0141ca
Last Affected
19e688830a7b47ff74857555288733c9df8cef50
Introduced
9e1bcd8531e89bac4f2c23e534e8d7235de05580
Last Affected
0d051d2c8b12fd24f23d0849ef6eef777f6d3fc0
Introduced
af8d02bb26203d51353e6d81c7ced532bf88bf68
Last Affected
d8f21a82bf0d77712fd5632d45472daf02302ba0
Introduced
e107b1973a390cafc749031e033f37de7b9a4a1f
Last Affected
71398ebce2ffe466589ce3e6789f1cea6781931f
Database specific
Show details 
{
    "cpe":  [
        "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:beta2:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:beta3:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:beta4:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha1:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha2:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha3:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha4:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "14.8.5"
        },
        {
            "last_affected":  "14.8.9"
        },
        {
            "introduced":  "22.0.6"
        },
        {
            "last_affected":  "22.0.15"
        },
        {
            "introduced":  "23.0.1"
        },
        {
            "last_affected":  "23.0.8"
        },
        {
            "introduced":  "23.0.0-NA"
        },
        {
            "last_affected":  "23.0.0-NA"
        },
        {
            "introduced":  "23.0.0-beta2"
        },
        {
            "last_affected":  "23.0.0-beta2"
        },
        {
            "introduced":  "23.0.0-beta3"
        },
        {
            "last_affected":  "23.0.0-beta3"
        },
        {
            "introduced":  "23.0.0-beta4"
        },
        {
            "last_affected":  "23.0.0-beta4"
        },
        {
            "introduced":  "23.0.0-rc1"
        },
        {
            "last_affected":  "23.0.0-rc1"
        },
        {
            "introduced":  "23.1.0-alpha1"
        },
        {
            "last_affected":  "23.1.0-alpha1"
        },
        {
            "introduced":  "23.1.0-alpha2"
        },
        {
            "last_affected":  "23.1.0-alpha2"
        },
        {
            "introduced":  "23.1.0-alpha3"
        },
        {
            "last_affected":  "23.1.0-alpha3"
        },
        {
            "introduced":  "23.1.0-alpha4"
        },
        {
            "last_affected":  "23.1.0-alpha4"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

14.*
14.8.5
14.8.6
14.8.7
14.8.8
14.8.9
22.*
22.0.10
22.0.11
22.0.12
22.0.13
22.0.14
22.0.15
22.0.6
22.0.7
22.0.8
22.0.9
23.*
23.0.0
23.0.0-NA
23.0.0-beta2
23.0.0-beta3
23.0.0-beta4
23.0.0-rc1
23.0.0.beta2
23.0.0.beta3
23.0.0.beta4
23.0.0.rc1
23.0.1
23.0.2
23.0.3
23.0.4
23.0.5
23.0.6
23.0.7
23.0.8
23.1.0-alpha1
23.1.0-alpha2
23.1.0-alpha3
23.1.0-alpha4
23.1.0.alpha1
23.1.0.alpha2
23.1.0.alpha3
23.1.0.alpha4
v14.*
v14.8.5
v14.8.6
v14.8.7
v14.8.8
v14.8.9
v22.*
v22.0.10
v22.0.11
v22.0.12
v22.0.13
v22.0.14
v22.0.15
v22.0.6
v22.0.7
v22.0.8
v22.0.9
v23.*
v23.0.0
v23.0.1
v23.0.2
v23.0.3
v23.0.4
v23.0.5
v23.0.6
v23.0.7
v23.0.8
v23.1.0-alpha1
v23.1.0-alpha2
v23.1.0-alpha3
v23.1.0-alpha4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29567.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "227253610474657420000658638497856832181",
                "325547998130023685155870179560616361283",
                "264549496675469912738344520375456639123",
                "168441416726914295460019155720942763198",
                "303439880652311329003262891667535971196",
                "246815559709441532363689912362551173558",
                "302377633647492389705157050971342380269",
                "300218840941545479939337541484526173966",
                "68287953031691458000546692801069623235",
                "263065027422628275750912490098625604625",
                "183802768986209993314959803271964339569",
                "208038595260503375500860228201491984098",
                "216262777619120865416968809269528036178",
                "314459709021664788149524600442790668315",
                "232857988567520515487732049155279170023",
                "184711204978225754154429885156385223866",
                "277762406796287067185157291016056249236"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-29567-70b2cbe4",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/vaadin/flow-components/commit/8fe08611e304779df01ecd6306d478a9c0edced0",
        "target":  {
            "file":  "vaadin-grid-flow-parent/vaadin-grid-flow/src/main/java/com/vaadin/flow/component/treegrid/TreeGrid.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "250155782693343714630631065357399756347",
            "length":  622
        },
        "id":  "CVE-2022-29567-722384cf",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/vaadin/flow-components/commit/8fe08611e304779df01ecd6306d478a9c0edced0",
        "target":  {
            "file":  "vaadin-grid-flow-parent/vaadin-grid-flow-integration-tests/src/main/java/com/vaadin/flow/component/treegrid/it/TreeGridPreloadPage.java",
            "function":  "setDataProvider"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "188402487619299096108953219894411615845",
            "length":  1750
        },
        "id":  "CVE-2022-29567-8c2b5ce7",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/vaadin/flow-components/commit/8fe08611e304779df01ecd6306d478a9c0edced0",
        "target":  {
            "file":  "vaadin-grid-flow-parent/vaadin-grid-flow-integration-tests/src/main/java/com/vaadin/flow/component/treegrid/it/TreeGridPreloadPage.java",
            "function":  "TreeGridPreloadPage"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "274108684783086354814437216584552015536",
                "277539696549176848440428307085227334616",
                "156886772506292107536391189984379743834",
                "233211424031949977857866557792026527220",
                "335307821439601120976978490567030304348",
                "268566790089202053953879739342540544168",
                "239955306471911677062382327512418465971",
                "45688970776578600652230586957721116862"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-29567-fb967937",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/vaadin/flow-components/commit/8fe08611e304779df01ecd6306d478a9c0edced0",
        "target":  {
            "file":  "vaadin-grid-flow-parent/vaadin-grid-flow-integration-tests/src/main/java/com/vaadin/flow/component/treegrid/it/TreeGridPreloadPage.java"
        }
    }
]
vanir_signatures_modified 
"2026-09-16T08:29:32Z"