CVE-2020-25724 Unsynchronized Access to Shared Data in a Multithreaded Context in RESTEasy
An attacker can exploit incorrect HTTP responses in RESTEasy to access privileged information, compromising confidentiality and integrity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-25724?
CVE-2020-25724 is a medium-severity vulnerability in resteasy, published on 26 May 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerability is to confidentiality and integrity. Versions before resteasy 2.0.0.Alpha3 are affected.
Weakness: CWE-567
Which versions are affected by CVE-2020-25724?
2 open source packages ship an affected version, including org.jboss.resteasy:resteasy-bom. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.jboss.resteasy:resteasy-bom Maven | All versions | 2.0-beta-2 |
org.jboss.resteasy:resteasy-bom Maven | All versions | 2.0-beta-2 |
Products include Quarkus Quarkus, Redhat Resteasy.
How do I fix CVE-2020-25724?
Upgrade org.jboss.resteasy:resteasy-bom to 2.0-beta-2 or later.
Is CVE-2020-25724 being exploited?
There is no known exploitation of CVE-2020-25724 in the wild and no public exploit code.
Other vulnerabilities in resteasy
- CVE-2022-4116 Code injection in quarkus dev ui config editor
- CVE-2022-2466 Quarkus does not terminate HTTP requests header context
- CVE-2024-12225 Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass
- CVE-2026-39852 Quarkus authorization bypass via semicolon path normalization inconsistency
- CVE-2022-0981 Privilege escalation in quarkus
Sources
Also known as GHSA-9699-gm7f-cmjv.