resteasy: Error message exposes endpoint class information

🗓️ 15 Nov 2021 17:05:54Reported by RedHatType

RESTEasy reveals endpoint class and method names in error responses during URI parameter conversion failures; vulnerable up to version 4.6.0.Final.

Reporter	Title	Published	Views	Family All 87
ATTACKERKB	CVE-2021-20289	26 Mar 202117:15	–	attackerkb
Tenable Nessus	Amazon Linux 2 : resteasy-base (ALAS-2024-2398)	9 Jan 202400:00	–	nessus
Tenable Nessus	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 7 (Moderate) (RHSA-2021:4676)	17 Nov 202100:00	–	nessus
Tenable Nessus	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 8 (Moderate) (RHSA-2021:4677)	16 Nov 202100:00	–	nessus
Tenable Nessus	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 6 (Moderate) (RHSA-2021:5149)	15 Dec 202100:00	–	nessus
Tenable Nessus	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 7 (Moderate) (RHSA-2021:5150)	15 Dec 202100:00	–	nessus
Tenable Nessus	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 8 (Moderate) (RHSA-2021:5151)	16 Dec 202100:00	–	nessus
Tenable Nessus	RHEL 7 : Red Hat Single Sign-On 7.5.1 security update on RHEL 7 (Important) (RHSA-2022:0151)	18 Jan 202200:00	–	nessus
Tenable Nessus	RHEL 8 : Red Hat Single Sign-On 7.5.1 security update on RHEL 8 (Important) (RHSA-2022:0152)	18 Jan 202200:00	–	nessus
Tenable Nessus	RHEL 7 : resteasy (Unpatched Vulnerability)	11 May 202400:00	–	nessus

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-20289
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-20289
cve	www.cve.org/CVERecord

10 Aug 2026 20:28Current

7High risk

Vulners AI Score7

CVSS 25

CVSS 3.15.3

EPSS0.014