{"action":"Upgrade com.vaadin:vaadin to 10.0.24 (10.0.x), 14.10.2 (14.10.x), 22.1.0 (22.1.x), 23.3.14 (23.3.x), 24.0.7 (24.0.x) or 24.1.0 (24.1.x) or later.","affected":[{"fixed":"10.0.24","introduced":"10.0.0"},{"fixed":"14.10.2","introduced":"11.0.0"},{"fixed":"22.1.0","introduced":"15.0.0"},{"fixed":"23.3.14","introduced":"23.0.0"},{"fixed":"24.0.7","introduced":"24.0.0"},{"fixed":"24.1.0","introduced":"24.1.0.alpha1"}],"component":"com.vaadin:vaadin","cve_ids":["CVE-2023-25500"],"ecosystem":"Maven","epss":0.00514,"exploited":false,"fixed_versions":["10.0.24","14.10.2","22.1.0","23.3.14","24.0.7","24.1.0"],"ghsa_id":"GHSA-ch48-9r3q-pv7x","id":"tcs_01M5N8SE95Z5GHH2PAR4JW7AYB","modified_at":"2024-02-16T08:21:06.374976Z","published_at":"2023-06-22T20:01:03Z","references":["https://osv.dev/vulnerability/GHSA-ch48-9r3q-pv7x","https://github.com/vaadin/platform/security/advisories/GHSA-ch48-9r3q-pv7x","https://nvd.nist.gov/vuln/detail/CVE-2023-25500","https://github.com/vaadin/flow/pull/16935","https://github.com/vaadin/platform","https://vaadin.com/security/cve-2023-25500"],"severity":{"label":"low","score":3.5},"sources":[{"source":"osv","source_id":"GHSA-ch48-9r3q-pv7x#Maven/com.vaadin:vaadin","url":"https://osv.dev/vulnerability/GHSA-ch48-9r3q-pv7x"}],"summary":"Vaadin vulnerable to possible information disclosure of class and method names in RPC response"}