RESTEasy's default exception mapper returns an exception's localized message in the HTTP 500 response body when no application exception mapper…
RESTEasy's default exception mapper returns an exception's localized message in the HTTP 500 response body when no application exception mapper handles an unhandled exception other than a WebApplicationException. A remote unauthenticated client who can trigger such an exception may receive information included in the message. Fabio Burzigotti reports reproducing the behavior with RESTEasy 7.0.2.Final. The complete affected and fixed version ranges remain to be confirmed.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Red Hat
- Product
- Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3
- CVSS v3.1
- 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Fix
- available
- Weakness
- CWE-209
- Exposure class
- Web platform, Identity
- NVD status
- Awaiting Analysis
Why it ranks 35 (Notable)
- CVSS v3.1 5.3 medium
- Exposed product class: identity
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.