GHSA-54fx-gm74-q676

ghsaUSosv

Permissions bypass in SmallRye

view advisory published 2022-03-18Licence: CC-BY-4.0

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-1729US	medium4.4OT elevated	0.27% (18th)	—	2021-05-28
A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any pe…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=1802444WEB
https://github.com/smallrye/smallrye-config/commit/fb0def6f61c09a2a80c9145e4ec6521225cd0b99WEB
https://nvd.nist.gov/vuln/detail/CVE-2020-1729ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan