What is CVE-2020-1729?

CVE-2020-1729 is a medium-severity vulnerability in Red Hat Smallrye Config, classified under Incorrect Authorization. CVSS score: 4.4/10. Published 2021-05-28.

How severe is CVE-2020-1729?

Medium severity. CVSS v3 base score is 4.4 out of 10.

Is CVE-2020-1729 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Red Hat Smallrye Config

CVE-2020-1729

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2

Vulnerability class: Broken Access Control

EPSS: 0.003 (18.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

Affected products

Redhat Smallrye_config
N/a Smallrye — versions SmallRye 1.6.1

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

secalert@redhat.com (Patch, x_refsource_MISC, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2020-1729?: CVE-2020-1729 is a medium-severity vulnerability in Red Hat Smallrye Config, classified under Incorrect Authorization. CVSS score: 4.4/10. Published 2021-05-28.
How severe is CVE-2020-1729?: Medium severity. CVSS v3 base score is 4.4 out of 10.
Is CVE-2020-1729 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.