CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2021-20289
Medium (5.3). EPSS 1.4% chance of exploitation in the next 30 days. Fixed in org.jboss.resteasy:resteasy-core 3.16.0, 4.5.10, 4.6.1.
A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
- CWE
- CWE-209
- Published
- Modified
- Record from
- the NVD, synced
Affected
- netapp:oncommand_insight
- oracle:communications_cloud_native_core_console
- quarkus:quarkus
- redhat:resteasy
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-244r-fcj3-ghjq | Maven | org.jboss.resteasy:resteasy-core | >=4.6.0 <4.6.1 | 4.6.1 |
| GHSA-244r-fcj3-ghjq | Maven | org.jboss.resteasy:resteasy-core | >=4.0.0 <4.5.10 | 4.5.10 |
| GHSA-244r-fcj3-ghjq | Maven | org.jboss.resteasy:resteasy-core | >=3.0.0 <3.16.0 | 3.16.0 |