CVE-2025-1247

highpriority · track · 0EPSS 0.008 · 57 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.82% (57th) EPSS

CVSS 8.3 · high

Is it mine?

42 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · osv

EPSS · scored 2026-10-27

A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.

cvss

Technical severity, 0–10. One row per scoring source.

8.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Lsecondary · ENISA EU

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Lsecondary · secalert@redhat.com USexploitability 2.8 · impact 5.5

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Lsecondary · OSV

v3.17.6highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-488USCWE-488US

affected products (42)

Products and version ranges known to be affected.

Atlassian Bamboo <10.2.2all versionscert_bundDE
Atlassian Bamboo <9.6.11all versionscert_bundDE
Dell Secure Connect Gateway <5.34.00.16all versionscert_bundDE
Hitachi Ops Centerall versionscert_bundDEcpe:/a:hitachi:ops_center:-
IBM FlashSystemall versionscert_bundDEcpe:/a:ibm:flashsystem:-
IBM InfoSphere Information Server 11.7all versionscert_bundDEcpe:/a:ibm:infosphere_information_server:11.7
IBM License Metric Toolall versionscert_bundDEcpe:/a:ibm:license_metric_tool:-
IBM Maximo Asset Management 7.6.1all versionscert_bundDEcpe:/a:ibm:maximo_asset_management:7.6.1
IBM Operational Decision Manager <V8.11.0.1 Interim fix 042all versionscert_bundDE
IBM Operational Decision Manager <V8.11.1.0: Interim fix 039all versionscert_bundDE
IBM Operational Decision Manager <V8.12.0.1: Interim fix 024all versionscert_bundDE
IBM Operational Decision Manager <V9.0.0.1: Interim fix 007all versionscert_bundDE
IBM QRadar SIEMall versionscert_bundDEcpe:/a:ibm:qradar_siem:-
IBM SAN Volume Controllerall versionscert_bundDEcpe:/a:ibm:san_volume_controller:-
IBM SPSS Analytic Serverall versionscert_bundDEcpe:/a:ibm:spss:analytic_server
IBM Security Guardium 12all versionscert_bundDEcpe:/a:ibm:security_guardium:sqlguard_12.0p35_bundle_jan-28-2025
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux Apache Camel 1all versionscert_bundDEcpe:/o:redhat:enterprise_linux:apache_camel_1
Red Hat Enterprise Linux Quarkus <3.15.3.SP1all versionscert_bundDE
Red Hat Enterprise Linux Quarkus <3.20.1all versionscert_bundDE

showing 20 of 42

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-0460Red Hat Enterprise Linux (Quarkus): Mehrere SchwachstellenDeutsch2025-02-27csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in Quarkus auf Red Hat Enterprise Linux ausnutzen, um Informationen offenzulegen, oder einen Denial of Service auszulösen.
GHSA-phg3-gv66-q38xQuarkus REST Endpoint Request Parameter Leakage Due to Shared Instance2025-02-13ghsa · osvUS
A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund osv NVD CVE.org MITRE

published 2025-02-13modified 2026-10-20

references (15)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan