CVE-2022-29567

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-29567
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29567.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-29567
Aliases
Published
2022-05-24T14:20:19.452Z
Modified
2026-07-15T01:49:12.669100370Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Possible information disclosure inside TreeGrid component with default data provider
Details

The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29567.json",
    "cna_assigner": "Vaadin",
    "cwe_ids": [
        "CWE-200"
    ]
}
References

Affected packages

Git / github.com/vaadin/flow-components

Affected ranges

Type
GIT
Repo
https://github.com/vaadin/flow-components
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
86dd569d5e95697a10af1d501d7a320b7407d158
Last affected
e6f5e9c569ae4f75d15e324078750001966b0315
Last affected
498d3a421b7e7cb43c349438405fb75bf3b73e8b
Last affected
159604faaf6a9f2581222fdaf67140390b323fa4
Introduced
00014f67045798c8575939bdb1c16d3727a1ed55
Last affected
e0c963da12dd5c30e5e96ea48c7330b515aa62ed
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "14.8.9"
        },
        {
            "last_affected": "22.0.14"
        },
        {
            "last_affected": "23.0.8"
        },
        {
            "last_affected": "23.1.0.alpha4"
        },
        {
            "introduced": "14.8.5"
        },
        {
            "last_affected": "14.8.5"
        },
        {
            "introduced": "22.0.6"
        },
        {
            "last_affected": "22.0.6"
        },
        {
            "introduced": "23.0.0.beta2"
        },
        {
            "last_affected": "23.0.0.beta2"
        },
        {
            "introduced": "23.1.0.alpha1"
        },
        {
            "last_affected": "23.1.0.alpha1"
        }
    ]
}
Type
GIT
Repo
https://github.com/vaadin/platform
Events
Introduced
bc402cf899942f74a62993f8e612af466bee056f
Last affected
807b2087b918f43525d5bd443e3608bf86583322
Introduced
913a1d49e922efad85dbef6888b18bc011dc5650
Last affected
f2d230ec7a1ba939c7230723fac1089fad2b2006
Introduced
5430e0a3e45842600792de19a6a6784761c96da4
Last affected
ab17ce191141b2f8bb69e6a7cf4a1db075904c4f
Introduced
0b73a5a157b036577d09a9f65559714246ab6e6e
Last affected
1c505b3f9875b925113bed183136d8a357651e34
Database specific 
{
    "cpe": [
        "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:beta2:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:beta3:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:beta4:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha1:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha2:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha3:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha4:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "14.8.5"
        },
        {
            "last_affected": "14.8.9"
        },
        {
            "introduced": "22.0.6"
        },
        {
            "last_affected": "22.0.15"
        },
        {
            "introduced": "23.0.1"
        },
        {
            "last_affected": "23.0.8"
        },
        {
            "introduced": "23.0.0-NA"
        },
        {
            "last_affected": "23.0.0-NA"
        },
        {
            "introduced": "23.0.0-beta2"
        },
        {
            "last_affected": "23.0.0-beta2"
        },
        {
            "introduced": "23.0.0-beta3"
        },
        {
            "last_affected": "23.0.0-beta3"
        },
        {
            "introduced": "23.0.0-beta4"
        },
        {
            "last_affected": "23.0.0-beta4"
        },
        {
            "introduced": "23.0.0-rc1"
        },
        {
            "last_affected": "23.0.0-rc1"
        },
        {
            "introduced": "23.1.0-alpha1"
        },
        {
            "last_affected": "23.1.0-alpha1"
        },
        {
            "introduced": "23.1.0-alpha2"
        },
        {
            "last_affected": "23.1.0-alpha2"
        },
        {
            "introduced": "23.1.0-alpha3"
        },
        {
            "last_affected": "23.1.0-alpha3"
        },
        {
            "introduced": "23.1.0-alpha4"
        },
        {
            "last_affected": "23.1.0-alpha4"
        }
    ]
}
Type
GIT
Repo
https://github.com/vaadin/vaadin
Events
Introduced
acb11dbc88fa66aaca85c84bdb9158338b0141ca
Last affected
19e688830a7b47ff74857555288733c9df8cef50
Introduced
9e1bcd8531e89bac4f2c23e534e8d7235de05580
Last affected
0d051d2c8b12fd24f23d0849ef6eef777f6d3fc0
Introduced
af8d02bb26203d51353e6d81c7ced532bf88bf68
Last affected
d8f21a82bf0d77712fd5632d45472daf02302ba0
Introduced
e107b1973a390cafc749031e033f37de7b9a4a1f
Last affected
71398ebce2ffe466589ce3e6789f1cea6781931f
Database specific 
{
    "cpe": [
        "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:beta2:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:beta3:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:beta4:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.0.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha1:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha2:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha3:*:*:*:*:*:*",
        "cpe:2.3:a:vaadin:vaadin:23.1.0:alpha4:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "14.8.5"
        },
        {
            "last_affected": "14.8.9"
        },
        {
            "introduced": "22.0.6"
        },
        {
            "last_affected": "22.0.15"
        },
        {
            "introduced": "23.0.1"
        },
        {
            "last_affected": "23.0.8"
        },
        {
            "introduced": "23.0.0-NA"
        },
        {
            "last_affected": "23.0.0-NA"
        },
        {
            "introduced": "23.0.0-beta2"
        },
        {
            "last_affected": "23.0.0-beta2"
        },
        {
            "introduced": "23.0.0-beta3"
        },
        {
            "last_affected": "23.0.0-beta3"
        },
        {
            "introduced": "23.0.0-beta4"
        },
        {
            "last_affected": "23.0.0-beta4"
        },
        {
            "introduced": "23.0.0-rc1"
        },
        {
            "last_affected": "23.0.0-rc1"
        },
        {
            "introduced": "23.1.0-alpha1"
        },
        {
            "last_affected": "23.1.0-alpha1"
        },
        {
            "introduced": "23.1.0-alpha2"
        },
        {
            "last_affected": "23.1.0-alpha2"
        },
        {
            "introduced": "23.1.0-alpha3"
        },
        {
            "last_affected": "23.1.0-alpha3"
        },
        {
            "introduced": "23.1.0-alpha4"
        },
        {
            "last_affected": "23.1.0-alpha4"
        }
    ]
}

Affected versions

14.*
14.8.5
14.8.6
14.8.7
14.8.8
14.8.9
18.*
18.0.0.alpha1
18.0.0.beta1
18.0.0.beta2
19.*
19.0.0.alpha1
19.0.0.alpha2
19.0.0.alpha3
19.0.0.alpha4
19.0.0.alpha5
19.0.0.beta1
19.0.0.beta2
19.0.0.beta3
20.*
20.0.0.alpha1
20.0.0.alpha2
20.0.0.alpha3
20.0.0.alpha4
20.0.0.alpha5
20.0.0.alpha6
20.0.0.alpha7
20.0.0.alpha8
21.*
21.0.0.alpha1
21.0.0.alpha10
21.0.0.alpha2
21.0.0.alpha3
21.0.0.alpha4
21.0.0.alpha5
21.0.0.alpha6
21.0.0.alpha7
21.0.0.alpha8
21.0.0.alpha9
22.*
22.0.0
22.0.0.alpha1
22.0.0.alpha2
22.0.0.alpha3
22.0.0.alpha4
22.0.0.alpha5
22.0.0.alpha6
22.0.0.alpha7
22.0.0.alpha8
22.0.0.alpha9
22.0.0.beta1
22.0.0.beta2
22.0.0.beta3
22.0.0.rc1
22.0.1
22.0.10
22.0.11
22.0.12
22.0.13
22.0.14
22.0.15
22.0.2
22.0.3
22.0.4
22.0.5
22.0.6
22.0.7
22.0.8
22.0.9
23.*
23.0.0
23.0.0-NA
23.0.0-beta2
23.0.0-beta3
23.0.0-beta4
23.0.0-rc1
23.0.0.alpha1
23.0.0.alpha2
23.0.0.alpha3
23.0.0.alpha4
23.0.0.beta1
23.0.0.beta2
23.0.0.beta3
23.0.0.beta4
23.0.0.rc1
23.0.1
23.0.2
23.0.3
23.0.4
23.0.5
23.0.6
23.0.7
23.0.8
23.1.0-alpha1
23.1.0-alpha2
23.1.0-alpha3
23.1.0-alpha4
23.1.0.alpha1
23.1.0.alpha2
23.1.0.alpha3
23.1.0.alpha4
Other
migration
v14.*
v14.8.5
v14.8.6
v14.8.7
v14.8.8
v14.8.9
v22.*
v22.0.10
v22.0.11
v22.0.12
v22.0.13
v22.0.14
v22.0.15
v22.0.6
v22.0.7
v22.0.8
v22.0.9
v23.*
v23.0.0
v23.0.1
v23.0.2
v23.0.3
v23.0.4
v23.0.5
v23.0.6
v23.0.7
v23.0.8
v23.1.0-alpha1
v23.1.0-alpha2
v23.1.0-alpha3
v23.1.0-alpha4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29567.json"