// For flags

CVE-2021-20289

resteasy: Error message exposes endpoint class information

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.

Se detectó un fallo en RESTEasy en todas las versiones de RESTEasy hasta 4.6.0.Final. Los nombres de métodos y clases de endpoint son devueltos como parte de la respuesta de excepción cuando RESTEasy no puede convertir uno de los valores de consulta o ruta del URI de petición a el valor del parámetro de método del recurso JAX-RS correspondiente. La mayor amenaza de esta vulnerabilidad es la confidencialidad de los datos.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-12-17 CVE Reserved
  • 2021-03-26 CVE Published
  • 2023-12-10 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-209: Generation of Error Message Containing Sensitive Information
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Redhat
Search vendor "Redhat"
 Resteasy
Search vendor "Redhat" for product "Resteasy"
 <= 4.6.0
Search vendor "Redhat" for product "Resteasy" and version " <= 4.6.0"
-
Affected
Netapp
Search vendor "Netapp"
 Oncommand Insight
Search vendor "Netapp" for product "Oncommand Insight"
--
Affected
Quarkus
Search vendor "Quarkus"
 Quarkus
Search vendor "Quarkus" for product "Quarkus"
 < 1.13.4
Search vendor "Quarkus" for product "Quarkus" and version " < 1.13.4"
-
Affected
Oracle
Search vendor "Oracle"
 Communications Cloud Native Core Console
Search vendor "Oracle" for product "Communications Cloud Native Core Console"
 1.9.0
Search vendor "Oracle" for product "Communications Cloud Native Core Console" and version "1.9.0"
-
Affected