PT-2021-10084 · Smallrye · Smallrye

Ted Jongseok Won · Published 2021-05-28 · Updated 2022-03-18 · CVE-2020-1729

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SmallRye versions prior to 1.6.2

Description: A flaw in the API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied, posing a threat to data confidentiality.

Recommendations: For versions prior to 1.6.2, update to SmallRye 1.6.2 to resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-1729

GHSA-54FX-GM74-Q676

RHSA-2020:2058

RHSA-2020:2059

RHSA-2020:2060

RHSA-2020:2511

RHSA-2020:2512

RHSA-2020:2513

Affected Products

Smallrye

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-1729 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1802444 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-54fx-gm74-q676 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1729 · Vendor Advisory
• https://github.com/smallrye/smallrye-config/commit/fb0def6f61c09a2a80c9145e4ec6521225cd0b99 · Note
• https://t.me/cvenotify/15205 · Telegram Post
• https://t.me/cvenotify/15855 · Telegram Post