Medium severity · published Mar 26, 2021
CVE-2021-20289
A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final
5.3
CVSS
1.4%
EPSS
No
On KEV
Description
A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Communications Cloud Native Core Console · Oracle
1.9.0 · source: NVD
OI
Oncommand Insight · Netapp
All versions, or not specified · source: NVD
QU
Quarkus · Quarkus
before 1.13.4 · source: NVD
RE
Resteasy · Redhat
through 4.6.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20289
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20289
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1935927
Patch
https://www.oracle.com/security-alerts/cpuapr2022.html
More from Oncommand Insight
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
9.8
CVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
9.8
CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability
8.8
CVE-2023-41993
Apple Multiple Products WebKit Code Execution Vulnerability
8.8
CVE-2010-1871
Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability