Information disclosure in Red Hat build of Quarkus - CVE-2025-1247
Published: April 3, 2025
Vulnerability identifier: #VU106935
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-1247
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists in in Quarkus REST due to software leaks parameters between concurrent requests if endpoints use field injection without a CDI scope. A remote user can gain access to sensitive information.
Affected software
Red Hat build of Quarkus
IBM Business Automation Manager Open Editions
IBM Business Automation Manager Open Editions
How to mitigate CVE-2025-1247
Install updates from vendor's website.
Red Hat build of Quarkus - update to 3.15.3.SP1
IBM Business Automation Manager Open Editions - update to 9.2.1
IBM Business Automation Manager Open Editions - update to 9.2.1