Description
A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2
Remediation
References
https://bugzilla.redhat.com/show_bug.cgi?id=1802444
Related Vulnerabilities
CVE-2022-21191 Vulnerability in npm package global-modules-path
CVE-2023-41037 Vulnerability in npm package openpgp
CVE-2023-32689 Vulnerability in npm package parse-server
CVE-2022-24794 Vulnerability in npm package express-openid-connect
CVE-2023-26480 Vulnerability in maven package org.xwiki.platform:xwiki-platform-livedata-macro