Cross-site Scripting (XSS)

2020-03-2504:19:25

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

46.8%

JSON

resteasy-jaxrs is vulnerable to cross-site scripting (XSS). The vulnerability exists due to the lack of sanitization of the value of strVal, allowing RESTEASY003870 exceptions be used to execute arbitrary Javascript in a user’s browser.

CPENameOperatorVersion
resteasy jax-rs implementationle3.11.0.Final
eap7-stax2-apieq3.1.4__3.redhat_1.1.ep7.el6
eap7-stax2-apieq3.1.4__6.redhat_2.1.el6eap
eap7-stax2-apieq3.1.4__6.redhat_2.1.el7eap
eap7-stax2-apieq3.1.4__6.redhat_2.1.el8eap
eap7-stax2-apieq3.1.4__3.redhat_1.1.ep7.el7
eap7-jackson-databindeq2.9.9.3__1.redhat_00001.1.el6eap
eap7-jackson-databindeq2.9.9.3__1.redhat_00001.1.el8eap
eap7-jackson-databindeq2.8.11__1.redhat_1.1.ep7.el6
eap7-jackson-databindeq2.5.4__1.redhat_1.1.ep7.el7

Name	Operator	Version
resteasy jax-rs implementation	le	3.11.0.Final
eap7-stax2-api	eq	3.1.4__3.redhat_1.1.ep7.el6
eap7-stax2-api	eq	3.1.4__6.redhat_2.1.el6eap
eap7-stax2-api	eq	3.1.4__6.redhat_2.1.el7eap
eap7-stax2-api	eq	3.1.4__6.redhat_2.1.el8eap
eap7-stax2-api	eq	3.1.4__3.redhat_1.1.ep7.el7
eap7-jackson-databind	eq	2.9.9.3__1.redhat_00001.1.el6eap
eap7-jackson-databind	eq	2.9.9.3__1.redhat_00001.1.el8eap
eap7-jackson-databind	eq	2.8.11__1.redhat_1.1.ep7.el6
eap7-jackson-databind	eq	2.5.4__1.redhat_1.1.ep7.el7