CVE-2025-1247

{"id": "CVE-2025-1247", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}]}, "published": "2025-02-13T14:16:18.400", "references": [{"url": "https://access.redhat.com/errata/RHSA-2025:1884", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:1885", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:2067", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2025-1247", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345172", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-488"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en Quarkus REST que permite que los par\u00e1metros de solicitud se filtren entre solicitudes concurrentes si los endpoints usan la inyecci\u00f3n de campos sin un alcance CDI. Esta vulnerabilidad permite a los atacantes manipular los datos de la solicitud, hacerse pasar por usuarios o acceder a informaci\u00f3n confidencial."}], "lastModified": "2025-03-03T14:15:34.120", "sourceIdentifier": "secalert@redhat.com"}