Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2023-25500
vaadin vaadin — Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 2…
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L L N U L N N 4.3 .0051 41.7 —
AFFECTED
Product Versions Fixed
vaadin 10.0.0 – —
flow-server 1.0.0 – —
TIMELINE
Feb 6 Reserved by Vaadin
Jun 22 Published (CNA: Vaadin)
Sep 14 RESCORED — CVE-2023-25500 (vaadin). CVSS 3.5 → 4.3 (NVD).
Description
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| February 6, 2023 | Reserved | Reserved by Vaadin |
| June 22, 2023 | Published | Published (CNA: Vaadin) |
| September 14, 2026 | RESCORED | RESCORED — CVE-2023-25500 (vaadin). CVSS 3.5 → 4.3 (NVD). |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| vaadin | vaadin | Maven | 10.0.0 | — |
| flow | flow-server | Maven | 1.0.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-25500 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
