Vulnerability · Published May 28, 2021 · Assigned by redhat
CVE-2020-1729
Medium 4.4
In plain English
A medium-severity incorrect authorization in SmallRye. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)4.4Medium
Exploit odds (30 days)0.3%top 80.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | io.smallrye.config:smallrye-config | 1.6.2 | GHSA-54fx-gm74-q676 |
Affected products (as reported)
Weakness: CWE-863
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1802444 x_refsource_MISC