{"cve":"CVE-2020-1729","nvd":{"published":"2021-05-28T14:15:07.733","modified":"2026-06-17T03:02:17.283","status":"Modified","description":"A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","score":4.4},"cwes":["CWE-863"],"references":["https://bugzilla.redhat.com/show_bug.cgi?id=1802444","https://bugzilla.redhat.com/show_bug.cgi?id=1802444"],"products":["redhat:smallrye_config"],"source":"nvd","synced_at":"2026-10-19T21:18:09.669877188+00:00"},"epss":{"cve":"CVE-2020-1729","score":0.00269,"percentile":0.19138,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-54fx-gm74-q676","url":"https://osv.dev/vulnerability/GHSA-54fx-gm74-q676","summary":"Permissions bypass in SmallRye","modified":"2023-11-08T04:02:40.663165Z","packages":[{"ecosystem":"Maven","name":"io.smallrye.config:smallrye-config","purl":"pkg:maven/io.smallrye.config/smallrye-config","ranges":["<1.6.2"],"fixed":["1.6.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}