{"id":"CVE-2022-29567","summary":"Possible information disclosure inside TreeGrid component with default data provider","details":"The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.","aliases":["GHSA-qfr3-323w-qv27"],"modified":"2026-08-12T03:30:41.566268671Z","published":"2022-05-24T14:20:19.452Z","database_specific":{"cna_assigner":"Vaadin","cwe_ids":["CWE-200"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29567.json"},"references":[{"type":"WEB","url":"https://vaadin.com/security/cve-2022-29567"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29567.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29567"},{"type":"FIX","url":"https://github.com/vaadin/flow-components/pull/3046"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vaadin/flow-components","events":[{"introduced":"0"},{"last_affected":"86dd569d5e95697a10af1d501d7a320b7407d158"},{"last_affected":"e6f5e9c569ae4f75d15e324078750001966b0315"},{"last_affected":"498d3a421b7e7cb43c349438405fb75bf3b73e8b"},{"last_affected":"159604faaf6a9f2581222fdaf67140390b323fa4"},{"introduced":"00014f67045798c8575939bdb1c16d3727a1ed55"},{"last_affected":"e0c963da12dd5c30e5e96ea48c7330b515aa62ed"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"last_affected":"14.8.9"},{"last_affected":"22.0.14"},{"last_affected":"23.0.8"},{"last_affected":"23.1.0.alpha4"},{"introduced":"14.8.5"},{"last_affected":"14.8.5"},{"introduced":"22.0.6"},{"last_affected":"22.0.6"},{"introduced":"23.0.0.beta2"},{"last_affected":"23.0.0.beta2"},{"introduced":"23.1.0.alpha1"},{"last_affected":"23.1.0.alpha1"}]}},{"type":"GIT","repo":"https://github.com/vaadin/platform","events":[{"introduced":"bc402cf899942f74a62993f8e612af466bee056f"},{"last_affected":"807b2087b918f43525d5bd443e3608bf86583322"},{"introduced":"913a1d49e922efad85dbef6888b18bc011dc5650"},{"last_affected":"f2d230ec7a1ba939c7230723fac1089fad2b2006"},{"introduced":"5430e0a3e45842600792de19a6a6784761c96da4"},{"last_affected":"ab17ce191141b2f8bb69e6a7cf4a1db075904c4f"},{"introduced":"0b73a5a157b036577d09a9f65559714246ab6e6e"},{"last_affected":"1c505b3f9875b925113bed183136d8a357651e34"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:-:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:beta4:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.1.0:alpha1:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.1.0:alpha2:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.1.0:alpha3:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.1.0:alpha4:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.8.5"},{"last_affected":"14.8.9"},{"introduced":"22.0.6"},{"last_affected":"22.0.15"},{"introduced":"23.0.1"},{"last_affected":"23.0.8"},{"introduced":"23.0.0-NA"},{"last_affected":"23.0.0-NA"},{"introduced":"23.0.0-beta2"},{"last_affected":"23.0.0-beta2"},{"introduced":"23.0.0-beta3"},{"last_affected":"23.0.0-beta3"},{"introduced":"23.0.0-beta4"},{"last_affected":"23.0.0-beta4"},{"introduced":"23.0.0-rc1"},{"last_affected":"23.0.0-rc1"},{"introduced":"23.1.0-alpha1"},{"last_affected":"23.1.0-alpha1"},{"introduced":"23.1.0-alpha2"},{"last_affected":"23.1.0-alpha2"},{"introduced":"23.1.0-alpha3"},{"last_affected":"23.1.0-alpha3"},{"introduced":"23.1.0-alpha4"},{"last_affected":"23.1.0-alpha4"}]}},{"type":"GIT","repo":"https://github.com/vaadin/vaadin","events":[{"introduced":"acb11dbc88fa66aaca85c84bdb9158338b0141ca"},{"last_affected":"19e688830a7b47ff74857555288733c9df8cef50"},{"introduced":"9e1bcd8531e89bac4f2c23e534e8d7235de05580"},{"last_affected":"0d051d2c8b12fd24f23d0849ef6eef777f6d3fc0"},{"introduced":"af8d02bb26203d51353e6d81c7ced532bf88bf68"},{"last_affected":"d8f21a82bf0d77712fd5632d45472daf02302ba0"},{"introduced":"e107b1973a390cafc749031e033f37de7b9a4a1f"},{"last_affected":"71398ebce2ffe466589ce3e6789f1cea6781931f"}],"database_specific":{"extracted_events":[{"introduced":"14.8.5"},{"last_affected":"14.8.9"},{"introduced":"22.0.6"},{"last_affected":"22.0.15"},{"introduced":"23.0.1"},{"last_affected":"23.0.8"},{"introduced":"23.0.0-NA"},{"last_affected":"23.0.0-NA"},{"introduced":"23.0.0-beta2"},{"last_affected":"23.0.0-beta2"},{"introduced":"23.0.0-beta3"},{"last_affected":"23.0.0-beta3"},{"introduced":"23.0.0-beta4"},{"last_affected":"23.0.0-beta4"},{"introduced":"23.0.0-rc1"},{"last_affected":"23.0.0-rc1"},{"introduced":"23.1.0-alpha1"},{"last_affected":"23.1.0-alpha1"},{"introduced":"23.1.0-alpha2"},{"last_affected":"23.1.0-alpha2"},{"introduced":"23.1.0-alpha3"},{"last_affected":"23.1.0-alpha3"},{"introduced":"23.1.0-alpha4"},{"last_affected":"23.1.0-alpha4"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:-:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:beta4:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.1.0:alpha1:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.1.0:alpha2:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.1.0:alpha3:*:*:*:*:*:*","cpe:2.3:a:vaadin:vaadin:23.1.0:alpha4:*:*:*:*:*:*"]}}],"versions":["14.8.5","22.0.6","23.0.0-NA","23.0.0-beta2","23.0.0-beta3","23.0.0-beta4","23.0.0-rc1","23.0.0.beta2","23.1.0-alpha1","23.1.0-alpha2","23.1.0-alpha3","23.1.0-alpha4","23.1.0.alpha1","23.0.8","23.1.0.alpha4","14.8.9","14.8.8","23.0.7","22.0.14","23.1.0.alpha3","23.0.6","22.0.13","23.1.0.alpha2","23.0.5","22.0.12","23.0.4","14.8.7","14.8.6","23.0.3","22.0.11","22.0.10","23.0.2","23.0.1","22.0.9","22.0.8","23.0.0","22.0.7","23.0.0.rc1","23.0.0.beta4","23.0.0.beta3","22.0.5","23.0.0.beta1","23.0.0.alpha4","22.0.4","22.0.3","23.0.0.alpha3","23.0.0.alpha2","23.0.0.alpha1","22.0.2","22.0.1","22.0.0","22.0.0.rc1","22.0.0.beta3","22.0.0.beta2","22.0.0.beta1","22.0.0.alpha9","22.0.0.alpha8","22.0.0.alpha7","22.0.0.alpha6","22.0.0.alpha5","22.0.0.alpha4","22.0.0.alpha3","22.0.0.alpha2","22.0.0.alpha1","21.0.0.alpha10","21.0.0.alpha9","21.0.0.alpha8","21.0.0.alpha7","21.0.0.alpha6","21.0.0.alpha5","21.0.0.alpha4","21.0.0.alpha3","21.0.0.alpha2","21.0.0.alpha1","20.0.0.alpha8","20.0.0.alpha7","20.0.0.alpha6","20.0.0.alpha5","20.0.0.alpha4","20.0.0.alpha3","20.0.0.alpha2","20.0.0.alpha1","19.0.0.beta3","19.0.0.beta2","19.0.0.beta1","19.0.0.alpha5","19.0.0.alpha4","19.0.0.alpha3","19.0.0.alpha2","19.0.0.alpha1","18.0.0.beta2","18.0.0.beta1","18.0.0.alpha1","migration","22.0.15","v22.0.15","v23.0.8","v14.8.9","v22.0.14","v23.1.0-alpha4","v23.0.7","v23.1.0-alpha3","v23.0.6","v14.8.8","v22.0.13","v23.1.0-alpha2","v23.0.5","v23.1.0-alpha1","v23.0.4","v14.8.7","v22.0.12","v23.0.0","v23.0.3","v22.0.11","v14.8.6","v23.0.2","v22.0.10","v23.0.1","v22.0.9","v14.8.5","v22.0.8","v22.0.7","v22.0.6"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-29567.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"}]}