Medium severity · published May 27, 2021
CVE-2020-10688
A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the…
6.1
CVSS
1.4%
EPSS
No
On KEV
Description
A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FU
Fuse · Redhat
1.0 · source: NVD
JE
Jboss Enterprise Application Platform · Redhat
7.3; 7.4 · source: NVD
OA
Openshift Application Runtimes · Redhat
All versions, or not specified · source: NVD
RE
Resteasy · Redhat
before 3.11.1; 4.5.0 before 4.5.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10688
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10688
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1814974
Exploit
https://github.com/quarkusio/quarkus/issues/7248
Issue Tracking
https://issues.redhat.com/browse/RESTEASY-2519
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210706-0008/
More from Fuse
9.8
CVE-2016-4437
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access…
9.8
CVE-2015-1427
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell…
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g
9.8
CVE-2018-1270
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a…
9.8
CVE-2017-5645
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary…