CVE-2021-20289
Medium
Description
A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Redhat Resteasy
PublishedMar 26, 2021
First seenMar 26, 2021
Weakness typeCWE-209CWE-209
How to fix
Update
- quarkus quarkus1.13.4 or later
- org.jboss.resteasy:resteasy-core4.6.1, 4.5.10, 3.16.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat resteasy | v ≤ 4.6.0 | — |
| netapp oncommand_insight | No range specified | — |
| quarkus quarkus | v < 1.13.4 | 1.13.4 |
| oracle communications_cloud_native_core_console | 1.9.0 | — |
| org.jboss.resteasy:resteasy-coreMaven | 4.6.0 ≤ v < 4.6.1, 4.0.0 ≤ v < 4.5.10, 3.0.0 ≤ v < 3.16.0 | 4.6.1, 4.5.10, 3.16.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.