Medium severity5.7NVD Advisory· Published May 24, 2022· Updated Jun 17, 2026
CVE-2022-29567
CVE-2022-29567
Description
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.vaadin:vaadinMaven | >= 14.8.5, < 14.8.10 | 14.8.10 |
com.vaadin:vaadinMaven | >= 22.0.6, < 22.0.15 | 22.0.15 |
com.vaadin:vaadinMaven | >= 23.0.0, < 23.0.9 | 23.0.9 |
com.vaadin:vaadin-grid-flowMaven | >= 14.8.5, < 14.8.10 | 14.8.10 |
com.vaadin:vaadin-grid-flowMaven | >= 22.0.6, < 22.0.15 | 22.0.15 |
com.vaadin:vaadin-grid-flowMaven | >= 23.0.0.beta2, < 23.0.9 | 23.0.9 |
Affected products
14cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*+ 10 more
- cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*range: >=14.8.5,<=14.8.9
- cpe:2.3:a:vaadin:vaadin:23.0.0:-:*:*:*:*:*:*
- cpe:2.3:a:vaadin:vaadin:23.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:vaadin:vaadin:23.0.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:vaadin:vaadin:23.0.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:vaadin:vaadin:23.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:vaadin:vaadin:23.1.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:vaadin:vaadin:23.1.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:vaadin:vaadin:23.1.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:vaadin:vaadin:23.1.0:alpha4:*:*:*:*:*:*
- (no CPE)range: 14.8.5
- ghsa-coords2 versions
>= 14.8.5, < 14.8.10+ 1 more
- (no CPE)range: >= 14.8.5, < 14.8.10
- (no CPE)range: >= 14.8.5, < 14.8.10
- Vaadin/vaadin-grid-flowv5Range: 14.8.5
Patches
Vulnerability mechanics
References
5- github.com/vaadin/flow-components/pull/3046nvdIssue TrackingPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-qfr3-323w-qv27ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-29567ghsaADVISORY
- vaadin.com/security/cve-2022-29567nvdIssue TrackingVendor AdvisoryWEB
- github.com/vaadin/platform/security/advisories/GHSA-qfr3-323w-qv27ghsaWEB
News mentions
0No linked articles in our index yet.