GitHub Advisoryadvisory · Maven

GHSA-hr32-mgpm-qf2f Generation of Error Message Containing Sensitive Information in RESTEasy client

MEDIUM Published 2021-06-03 Modified 2021-06-03 Official page ↗
Aliases
CVE-2020-25633
Ecosystem
Maven
Packages
org.jboss.resteasy:resteasy-client, org.jboss.resteasy:resteasy-client-microprofile
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-209
Reviewed
2021-06-03

Affected packages

• Maven org.jboss.resteasy:resteasy-client: >= 4.0.0, < 4.5.7.Final → fixed in 4.5.7.Final • Maven org.jboss.resteasy:resteasy-client-microprofile: >= 4.0.0, < 4.5.7.Final → fixed in 4.5.7.Final • Maven org.jboss.resteasy:resteasy-client: < 3.14.0.Final → fixed in 3.14.0.Final • Maven org.jboss.resteasy:resteasy-client-microprofile: < 3.14.0.Final → fixed in 3.14.0.Final

Description

A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.

Related

Alias · CVE (1)

  • CVE-2020-25633 A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References