Red Hat resteasy-client
At a glance
- Source
- NVD
- EPSS
- EPSS 1.18 % · percentile 68 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.
Weaknesses (CWE)
- CWE-209 — Generation of Error Message Containing Sensitive Information
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | redhat |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-hr32-mgpm-qf2f — Generation of Error Message Containing Sensitive Information in RESTEasy client
European references
- ENISA EUVD · EUVD-2021-1336
- GCVE · GCVE-0-2020-25633
Affected configurations (NVD CPE)
cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:*< 3.14.0cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:*≥ 4.5.0 ≤ 4.5.6cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*≤ 1.11.6
Affected products
| Product | Versions |
|---|---|
| Red Hat · resteasy-client | affected through 4.5.6 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |