GHSA-29qj-rvv6-qrmv

ghsaUSosv

Cross-site scripting in RESTEasy

view advisory published 2021-06-15Licence: CC-BY-4.0

A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-10688US	medium6.1	1.39% (72nd)	—	2021-05-27
A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY00387…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=1814974WEB
https://github.com/quarkusio/quarkus/issues/7248WEB
https://issues.redhat.com/browse/RESTEASY-2519WEB
https://nvd.nist.gov/vuln/detail/CVE-2020-10688ADVISORY
https://security.netapp.com/advisory/ntap-20210706-0008WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan