CVE-2016-6345

RESTEasy: Insufficient use of random values in RESTEasy async jobs could lead to loss of data confidentiality

Loading…

Severity

Low

Red Hat Product Security

3.5

CVSS 3.0

Review impact separately from score.

Published · September 1, 2016

Updated · August 5, 2026

Description

It was found that there was insufficient use of randam values in RESTEasy async jobs. An attacker could use this flaw to steal user data.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Don't enable Async Jobs Service as details in the section, "2.10. RESTEASY ASYNCHRONOUS JOB SERVICE" of JBoss EAP 7 Developing Web Services Applications documentation: https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/7.0/paged/developing-web-services-applications/chapter-2-developing-jax-rs-web-services

CVSS / CWE

CVSS 3.0 · 3.5
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

CVSS 2.0 · 2.1
AV:N/AC:H/Au:S/C:P/I:N/A:N

CWE-330 · Use of Insufficiently Random Values