{"action":"Upgrade com.vaadin:flow-server to 1.0.21 (1.0.x), 2.9.3 (2.9.x), 9.1.2 (9.1.x), 23.3.13 (23.3.x), 24.0.9 (24.0.x) or 24.1.0 (24.1.x) or later.","affected":[{"fixed":"1.0.21","introduced":"1.0.0"},{"fixed":"2.9.3","introduced":"1.1.0"},{"fixed":"9.1.2","introduced":"3.0.0"},{"fixed":"23.3.13","introduced":"23.0.0"},{"fixed":"24.0.9","introduced":"24.0.0"},{"fixed":"24.1.0","introduced":"24.1.alpha1"}],"component":"com.vaadin:flow-server","cve_ids":["CVE-2023-25500"],"ecosystem":"Maven","epss":0.00514,"exploited":false,"fixed_versions":["1.0.21","2.9.3","9.1.2","23.3.13","24.0.9","24.1.0"],"ghsa_id":"GHSA-ch48-9r3q-pv7x","id":"tcs_01M5N8SE4F261SH20GQEDREADG","modified_at":"2024-02-16T08:21:06.374976Z","published_at":"2023-06-22T20:01:03Z","references":["https://osv.dev/vulnerability/GHSA-ch48-9r3q-pv7x","https://github.com/vaadin/platform/security/advisories/GHSA-ch48-9r3q-pv7x","https://nvd.nist.gov/vuln/detail/CVE-2023-25500","https://github.com/vaadin/flow/pull/16935","https://github.com/vaadin/platform","https://vaadin.com/security/cve-2023-25500"],"severity":{"label":"low","score":3.5},"sources":[{"source":"osv","source_id":"GHSA-ch48-9r3q-pv7x","url":"https://osv.dev/vulnerability/GHSA-ch48-9r3q-pv7x"}],"summary":"Vaadin vulnerable to possible information disclosure of class and method names in RPC response"}