Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Jastow: jastow cross-site scripting attack due to unsanitized uri (Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA)

CVE-2025-12799
MEDIUM 6.5

At a glance

Source
NVD
EPSS
EPSS 0.41 % · percentile 35 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Awaiting Analysis

Search on…

Description

A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters in URL with embedded Undertow and Jastow, a server might be vulnerable to improper input handling.

Weaknesses (CWE)

  • CWE-79 — Improper Neutralization of Input During Web Page Generation

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:Nredhat
CVSS 3.1MEDIUM 6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:NNVD · secalert@redhat.com (Secondary)

European references

Affected products

ProductVersions
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1.7.GAunaffected 2.2.9.SP1-redhat-00001 < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:1-9.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:2.40.0-7.redhat_00015.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 1:2.0.0-2.redhat_00005.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:1.8.0-2.redhat_00001.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:2.4.0-1.redhat_00002.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:2.3.0-1.redhat_00001.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:2.0.5-1.redhat_00001.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:2.0.3-1.redhat_00001.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:4.13.2-1.redhat_00001.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:1.11.0-1.redhat_00001.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:1.9.0-1.redhat_00001.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:1.17.2-1.redhat_00001.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:3.2.2-28.redhat_2.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:2.16.1-2.redhat_00002.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:3.18.0-2.redhat_00003.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:4.0.10-3.redhat_00001.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:4.1.0-1.redhat_00001.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:0.8.12-1.redhat_00001.1.el10eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10unaffected 0:2.14.0-4.redhat_00003.1.el10eap < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD