Cross-site scripting in RESTEasy

2021-06-1516:05:22

Google

osv.dev

0.001 Low

EPSS

Percentile

46.8%

JSON

A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.

CPENameOperatorVersion
org.jboss.resteasy:resteasy-bomeq2.3.1.GA
org.jboss.resteasy:resteasy-bomeq4.3.1.Final
org.jboss.resteasy:resteasy-coreeq4.3.1.Final
org.jboss.resteasy:resteasy-bomeq4.5.2.Final
org.jboss.resteasy:resteasy-bomeq3.6.1.SP1
org.jboss.resteasy:resteasy-bomeq4.4.2.Final
org.jboss.resteasy:resteasy-coreeq4.5.2.Final
org.jboss.resteasy:resteasy-bomeq4.1.1.Final
org.jboss.resteasy:resteasy-bomeq4.4.0.Final
org.jboss.resteasy:resteasy-bomeq4.0.0.Final

Name	Operator	Version
org.jboss.resteasy:resteasy-bom	eq	2.3.1.GA
org.jboss.resteasy:resteasy-bom	eq	4.3.1.Final
org.jboss.resteasy:resteasy-core	eq	4.3.1.Final
org.jboss.resteasy:resteasy-bom	eq	4.5.2.Final
org.jboss.resteasy:resteasy-bom	eq	3.6.1.SP1
org.jboss.resteasy:resteasy-bom	eq	4.4.2.Final
org.jboss.resteasy:resteasy-core	eq	4.5.2.Final
org.jboss.resteasy:resteasy-bom	eq	4.1.1.Final
org.jboss.resteasy:resteasy-bom	eq	4.4.0.Final
org.jboss.resteasy:resteasy-bom	eq	4.0.0.Final