A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade resteasy-base-resteasy-pomUpgrade resteasy-base-atom-providerUpgrade resteasy-base-javadocUpgrade resteasy-base-clientUpgrade resteasy-base-jaxrs-allUpgrade resteasy-base-providers-pomUpgrade resteasy-base-tjwsUpgrade resteasy-base-jettison-providerUpgrade resteasy-baseUpgrade resteasy-base-jaxrsUpgrade resteasy-base-jackson-providerUpgrade resteasy-base-jaxb-providerUpgrade resteasy-base-jaxrs-api | Jan 10, 2024 | Mar 26, 2021 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 3, 2021 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 26, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 26, 2021 |
| Ubuntu | — | Upgrade libresteasy3.0-javaUpgrade libresteasy-java (Ubuntu Pro)Upgrade libresteasy-javaUpgrade libresteasy3.0-java (Ubuntu Pro) | Mar 14, 2025 | Mar 26, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub