GHSA-29qj-rvv6-qrmv
Cross-site scripting in RESTEasy
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jboss.resteasy:resteasy-bom | < 3.11.1.Final | 3.11.1.Final |
| Maven | org.jboss.resteasy:resteasy-bom | >= 4.0.0, < 4.5.3.Final | 4.5.3.Final |
| Maven | org.jboss.resteasy:resteasy-core | < 3.11.1.Final | 3.11.1.Final |
| Maven | org.jboss.resteasy:resteasy-core | >= 4.0.0, < 4.5.3.Final | 4.5.3.Final |
Details
As written in the advisory (Markdown source, shown as plain text).
A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.
References
External links from the advisory. They lead to third-party sites.