CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2020-25633
Medium (5.3). EPSS 1.2% chance of exploitation in the next 30 days. Fixed in org.jboss.resteasy:resteasy-client 3.14.0.Final, 4.5.7.Final.
A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- CWE
- CWE-209
- Published
- Modified
- Record from
- the NVD, synced
Affected
- quarkus:quarkus
- redhat:resteasy
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hr32-mgpm-qf2f | Maven | org.jboss.resteasy:resteasy-client | >=4.0.0 <4.5.7.Final | 4.5.7.Final |
| GHSA-hr32-mgpm-qf2f | Maven | org.jboss.resteasy:resteasy-client-microprofile | >=4.0.0 <4.5.7.Final | 4.5.7.Final |
| GHSA-hr32-mgpm-qf2f | Maven | org.jboss.resteasy:resteasy-client | <3.14.0.Final | 3.14.0.Final |
| GHSA-hr32-mgpm-qf2f | Maven | org.jboss.resteasy:resteasy-client-microprofile | <3.14.0.Final | 3.14.0.Final |