GitHub Advisoryadvisory · Maven

GHSA-244r-fcj3-ghjq Exposure of class information in RESTEasy

MEDIUM Published 2021-04-07 Modified 2022-04-22 Official page ↗
Aliases
CVE-2021-20289
Ecosystem
Maven
Packages
org.jboss.resteasy:resteasy-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-209, CWE-668
Reviewed
2021-03-31

Affected packages

• Maven org.jboss.resteasy:resteasy-core: >= 4.6.0, < 4.6.1 → fixed in 4.6.1 • Maven org.jboss.resteasy:resteasy-core: >= 4.0.0, < 4.5.10 → fixed in 4.5.10 • Maven org.jboss.resteasy:resteasy-core: >= 3.0.0, < 3.16.0 → fixed in 3.16.0

Description

A flaw was found in RESTEasy in all current versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.

Related

Alias · CVE (1)

  • CVE-2021-20289 A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. vulnerability

Weakness · CWE (2)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References