resteasy
At a glance
- Source
- NVD
- EPSS
- EPSS 1.40 % · percentile 73 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.
Weaknesses (CWE)
- CWE-209 — Generation of Error Message Containing Sensitive Information
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-244r-fcj3-ghjq — Exposure of class information in RESTEasy
European references
- ENISA EUVD · EUVD-2021-0732
- GCVE · GCVE-0-2021-20289
Affected configurations (NVD CPE)
cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:*≤ 4.6.0cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*< 1.13.4cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| resteasy | affected resteasy 3.11.5.Final, resteasy 3.15.2.Final, resteasy 4.5.10.Final, resteasy 4.6.1.Final, resteasy 4.6.2.Final |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |