Christian Knoop

**Name of the Vulnerable Software and Affected Versions** Vaadin versions 14.8.5 through 14.8.9 Vaadin versions 22.0.6 through 22.0.14 Vaadin versions 23.0.0.beta2 through 23.0.8 Vaadin versions 23.1.0.alpha1 through 23.1.0.alpha4 **Description** The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin, resulting in potential information disclosure of values that should not be available on the client-side. **Recommendations** For Vaadin versions 14.8.5 through 14.8.9, update the configuration to avoid using Object::toString as a key. For Vaadin versions 22.0.6 through 22.0.14, update the configuration to avoid using Object::toString as a key. For Vaadin versions 23.0.0.beta2 through 23.0.8, update the configuration to avoid using Object::toString as a key. For Vaadin versions 23.1.0.alpha1 through 23.1.0.alpha4, update the configuration to avoid using Object::toString as a key. As a temporary workaround, consider disabling the TreeGrid component until a proper configuration can be implemented.

Name of the Vulnerable Software and Affected Versions: com.vaadin:flow-server versions 3.0.0 through 3.0.5 Vaadin versions 15.0.0 through 15.0.4 Description: The issue is related to an insecure configuration of the default `ObjectMapper` in the affected software. This may expose sensitive data if the application also uses certain annotations, such as `@RestController`. Recommendations: For com.vaadin:flow-server versions 3.0.0 through 3.0.5, update the configuration of the default `ObjectMapper` to secure it. For Vaadin versions 15.0.0 through 15.0.4, update the configuration of the default `ObjectMapper` to secure it. As a temporary workaround, consider restricting the use of `@RestController` in applications using the affected versions until a secure configuration is applied.