Not rated
CVE-2021-20293 A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where…
Description
A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected XSS attack. The highest threat from this vulnerability is to data confidentiality and integrity.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| RESTEasy | Versions not published |
Other CVEs of RESTEasy
The 6 CVEs of RESTEasy →
CVE-2023-0482
In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround…
5.5
Medium
CVE-2020-14326
A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes
Not rated
CVE-2020-10688
A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it…
Not rated
CVE-2020-25724
A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided
Not rated