RESTEasy
En bref
- Source
- NVD
- EPSS
- EPSS 1.39 % · centile 72 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.
Faiblesses (CWE)
- CWE-79 — Injection de code indirecte (XSS)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-29qj-rvv6-qrmv — Cross-site scripting in RESTEasy
Références européennes
- ENISA EUVD · EUVD-2021-1240
- GCVE · GCVE-0-2020-10688
Configurations affectées (CPE NVD)
cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:*cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:*< 3.11.1cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.3cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| RESTEasy | affected resteasy 3.11.1.Final, resteasy 4.5.3.Final |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |