Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

2022-05-1703:49:16

Google

osv.dev

0.001 Low

EPSS

Percentile

45.3%

JSON

RESTEasy allows remote authenticated users to obtain sensitive information by leveraging “insufficient use of random values” in async jobs.

CPENameOperatorVersion
org.jboss.resteasy:resteasy-clienteq3.0.17.Final
org.jboss.resteasy:resteasy-clienteq3.0-beta-6
org.jboss.resteasy:resteasy-clienteq1.0-beta-8
org.jboss.resteasy:resteasy-clienteq3.0.0.Final
org.jboss.resteasy:resteasy-clienteq3.0.6.Final
org.jboss.resteasy:resteasy-clienteq3.0-beta-5
org.jboss.resteasy:resteasy-clienteq1.0-beta-6
org.jboss.resteasy:resteasy-clienteq3.0.13.Final
org.jboss.resteasy:resteasy-clienteq3.0.4.Final
org.jboss.resteasy:resteasy-clienteq3.0.8.Final

Name	Operator	Version
org.jboss.resteasy:resteasy-client	eq	3.0.17.Final
org.jboss.resteasy:resteasy-client	eq	3.0-beta-6
org.jboss.resteasy:resteasy-client	eq	1.0-beta-8
org.jboss.resteasy:resteasy-client	eq	3.0.0.Final
org.jboss.resteasy:resteasy-client	eq	3.0.6.Final
org.jboss.resteasy:resteasy-client	eq	3.0-beta-5
org.jboss.resteasy:resteasy-client	eq	1.0-beta-6
org.jboss.resteasy:resteasy-client	eq	3.0.13.Final
org.jboss.resteasy:resteasy-client	eq	3.0.4.Final
org.jboss.resteasy:resteasy-client	eq	3.0.8.Final