CVE-2020-1729

SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader

Published May 28, 2021 CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Description
A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-1318 A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2
Github GHSA Github GHSA GHSA-54fx-gm74-q676 Permissions bypass in SmallRye
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 4, 2024, 6:46 AM
Reserved
Nov 27, 2019, 12:00 AM
Status
Modified
Published
May 28, 2021, 2:15 PM
Modified
Jun 17, 2026, 3:02 AM
Severity
Low
Public date
Feb 13, 2020, 12:00 AM