GitHub Advisoryadvisory · Maven

GHSA-29qj-rvv6-qrmv Cross-site scripting in RESTEasy

MEDIUM Published 2021-06-15 Modified 2021-06-01 Official page ↗
Aliases
CVE-2020-10688
Ecosystem
Maven
Packages
org.jboss.resteasy:resteasy-bom, org.jboss.resteasy:resteasy-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-06-01

Affected packages

• Maven org.jboss.resteasy:resteasy-bom: < 3.11.1.Final → fixed in 3.11.1.Final • Maven org.jboss.resteasy:resteasy-bom: >= 4.0.0, < 4.5.3.Final → fixed in 4.5.3.Final • Maven org.jboss.resteasy:resteasy-core: < 3.11.1.Final → fixed in 3.11.1.Final • Maven org.jboss.resteasy:resteasy-core: >= 4.0.0, < 4.5.3.Final → fixed in 4.5.3.Final

Description

A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.

Related

Alias · CVE (1)

  • CVE-2020-10688 A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References