CVE-2025-1247

high Apache
CVSS v3 Base Score
8.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
EPSS Score
0.8%
Exploitation probability in 30 days
Top 48% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Published: February 13, 2025 (571 days ago)
Last Modified: August 4, 2026
Vendor: Apache
Source: MITRE

Description

A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.

CWE

CWE-488

Affected Products

Red Hat Red Hat Build of Apache Camel 4.8 for Quarkus 3.15Red Hat Red Hat build of Quarkus 3.15.3.SP1Red Hat Red Hat build of Quarkus 3.8.6.SP3

References

🔗 access.redhat.com 🔗 access.redhat.com 🔗 access.redhat.com 🔗 access.redhat.com 🔗 bugzilla.redhat.com