resteasy: Error message exposes endpoint class information

🗓️ 15 Dec 2021 14:42:27Reported by RedHatType

RESTEasy up to 4.6.0.Final exposes endpoint class names and method names in error responses when URI or query values fail to parse, risking confidentiality.

Reporter	Title	Published	Views	Family All 88
Tenable Nessus	Amazon Linux 2 : resteasy-base (ALAS-2024-2398)	9 Jan 202400:00	–	nessus
Tenable Nessus	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 7 (Moderate) (RHSA-2021:4676)	17 Nov 202100:00	–	nessus
Tenable Nessus	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 8 (Moderate) (RHSA-2021:4677)	16 Nov 202100:00	–	nessus
Tenable Nessus	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 6 (Moderate) (RHSA-2021:5149)	15 Dec 202100:00	–	nessus
Tenable Nessus	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 7 (Moderate) (RHSA-2021:5150)	15 Dec 202100:00	–	nessus
Tenable Nessus	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 8 (Moderate) (RHSA-2021:5151)	16 Dec 202100:00	–	nessus
Tenable Nessus	RHEL 7 : Red Hat Single Sign-On 7.5.1 security update on RHEL 7 (Important) (RHSA-2022:0151)	18 Jan 202200:00	–	nessus
Tenable Nessus	RHEL 8 : Red Hat Single Sign-On 7.5.1 security update on RHEL 8 (Important) (RHSA-2022:0152)	18 Jan 202200:00	–	nessus
Tenable Nessus	RHEL 7 : resteasy (Unpatched Vulnerability)	11 May 202400:00	–	nessus
Tenable Nessus	RHEL 8 : candlepin (Unpatched Vulnerability)	3 Jun 202400:00	–	nessus

Vulners

Node

AND

redhat jboss_enterprise_application_platformRange<7.3

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-20289
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-20289
cve	www.cve.org/CVERecord

28 Jun 2026 12:35Current

7High risk

Vulners AI Score7

CVSS 25

CVSS 3.15.3

EPSS0.01439

CWE-209