CVE-2021-20289

Name of the Vulnerable Software and Affected Versions RESTEasy versions up to 4.6.0.Final

Description A flaw was found in RESTEasy where the endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. This poses a threat to data confidentiality.

Recommendations For versions up to 4.6.0.Final, consider updating to a version later than 4.6.0.Final to resolve the issue. As a temporary workaround, consider restricting access to sensitive information that could be exposed through the exception response.