CVE-2022-29567: Possible information disclosure inside TreeGrid component with default data provider
5.7
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.38521%
CWE
Published
5/25/2022
Updated
5/15/2024
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.vaadin:vaadin | maven | >= 14.8.5, < 14.8.10 | 14.8.10 |
| com.vaadin:vaadin | maven | >= 22.0.6, < 22.0.15 | 22.0.15 |
| com.vaadin:vaadin | maven | >= 23.0.0, < 23.0.9 | 23.0.9 |
| com.vaadin:vaadin-grid-flow | maven | >= 14.8.5, < 14.8.10 | 14.8.10 |
| com.vaadin:vaadin-grid-flow | maven | >= 22.0.6, < 22.0.15 | 22.0.15 |
| com.vaadin:vaadin-grid-flow | maven | >= 23.0.0.beta2, < 23.0.9 | 23.0.9 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from using Object::toString() as the default key provider in TreeGrid's data communication. The GitHub PR #3046 shows the fix replaced this with numeric IDs, explicitly addressing the toString() exposure. The affected methods are core data provider initialization points in TreeGrid.java, where the default key provider would be set unless explicitly overridden. The high confidence comes from direct evidence in commit messages and the patching strategy focused on these methods.