CVE-2020-1729

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	SmallRye	SmallRye 1.6.1

References

https://bugzilla.redhat.com/show_bug.cgi?id=1802444Issue Tracking, Patch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1802444Issue Tracking, Patch, Vendor Advisory

Timeline

Published: May 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-17305.3A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The ser CVE-2020-17319.8A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin CVE-2020-17324.2A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across CVE-2020-17335.0A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivi CVE-2020-17347.4A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() wi CVE-2020-17354.6A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then ch CVE-2020-173528.8Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow an authenticated atta CVE-2020-173539.8scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-p CVE-2020-173548.6LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated b CVE-2020-173557.5Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denia CVE-2020-17363.3A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the dest CVE-2020-173607.8An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h contains multiple boundary checks t