WaratekVRT Sign in

Medium Resteasy CVEs

15 CVEs, 3 protected by Waratek

Reset
More filters (1)
Columns
Product resteasy✕
Overview 15 matches · 3 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
15matches 3protected20.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 3 20.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 12 80.0%
Critical 0 0.0% High 0 0.0% Medium 15 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 20.0% partly blocked 0 0.0% not blocked 12 80.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 15 100.0%
split by peak 4 / year
No exploit published: 12Protected by Waratek: 3 Medium: 15 not blocked: 12blocked by ARMR today: 3 No public exploit: 15
20122 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2 20130 20141 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20150 20161 No exploit published1 Medium1 not blocked1 No public exploit1 20172 No exploit published2 Medium2 not blocked2 No public exploit2 20180 20190 20201 No exploit published1 Medium1 not blocked1 No public exploit1 20214 No exploit published4 Medium4 not blocked4 No public exploit4 20220 20231 No exploit published1 Medium1 not blocked1 No public exploit1 20243 No exploit published3 Medium3 not blocked3 No public exploit3
2012201420162018202020222024
15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-9622 Medium 2024-10-08 No exploit published No public exploit A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD_MESSAGE state. As a result, any subsequent legitimate requests on the same connection are ignored, leading to client timeouts, which may impact systems using load balancers and expose them to risk.
CVE-2024-1726 Medium 2024-04-25 No exploit published No public exploit A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.
CVE-2023-5675 Medium 2024-04-25 No exploit published No public exploit A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
CVE-2023-0482 Medium 2023-02-17 No exploit published No public exploit In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.
CVE-2021-20293 Medium 2021-06-10 No exploit published No public exploit A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected XSS attack. The highest threat from this vulnerability is to data confidentiality and integrity.
CVE-2020-10688 Medium 2021-05-27 No exploit published No public exploit A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.
CVE-2020-25724 Medium 2021-05-26 No exploit published No public exploit A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerability is to confidentiality and integrity. Versions before resteasy 2.0.0.Alpha3 are affected.
CVE-2021-20289 Medium 2021-03-26 No exploit published No public exploit A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.
CVE-2020-25633 Medium 2020-09-18 No exploit published No public exploit A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.
CVE-2016-6347 Medium 2017-04-20 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-6348 Medium 2017-04-12 No exploit published No public exploit JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack.
CVE-2016-6345 Medium 2016-09-07 No exploit published No public exploit RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs.
CVE-2014-7839 Medium 2014-11-25 Protected by Waratek No public exploit DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.
CVE-2012-0818 Medium 2012-11-23 Protected by Waratek No public exploit RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.
CVE-2011-5245 Medium 2012-11-23 Protected by Waratek No public exploit The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.