Dismissed
(no matching packages found)
Permalink
CVE-2025-12799
6.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): Low (L)
- Integrity (I): High (H)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): None (N)
Activity log
- Created & dismissed (no matching packages found) suggestion
Jastow: jastow cross-site scripting attack due to unsanitized uri
A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters in URL with embedded Undertow and Jastow, a server might be vulnerable to improper input handling.
References
Affected products
eap8
- *
jastow
eap8-ecj
- *
eap8-vdx
- *
eap8-gson
- *
eap8-hppc
- *
eap8-jaxb
- *
eap8-angus
- *
eap8-jansi
- *
eap8-log4j
- *
eap8-netty
- *
eap8-slf4j
- *
eap8-wss4j
- *
eap8-agroal
- *
eap8-antlr4
- *
eap8-jandex
- *
eap8-jasypt
- *
eap8-jberet
- *
eap8-jose4j
- *
eap8-neethi
- *
eap8-wsdl4j
- *
eap8-yasson
- *
eap8-fge-btf
- *
eap8-hornetq
- *
eap8-jctools
- *
eap8-jgroups
- *
eap8-parsson
- *
eap8-stax-ex
- *
eap8-wildfly
- *
eap8-atinject
- *
eap8-caffeine
- *
eap8-javaewah
- *
eap8-jsf-impl
- *
eap8-narayana
- *
eap8-opensaml
- *
eap8-resteasy
- *
eap8-undertow
- *
eap8-velocity
- *
eap8-asyncutil
- *
eap8-expressly
- *
eap8-hibernate
- *
eap8-jboss-dmr
- *
eap8-jboss-msc
- *
eap8-jboss-vfs
- *
eap8-joda-time
- *
eap8-saaj-impl
- *
eap8-snakeyaml
- *
eap8-stax2-api
- *
eap8-weld-core
- *
eap8-apache-cxf
- *
eap8-byte-buddy
- *
eap8-gnu-getopt
- *
eap8-h2database
- *
eap8-infinispan
- *
eap8-jaxbintros
- *
eap8-jboss-aesh
- *
eap8-json-patch
- *
eap8-jsonb-spec
- *
eap8-staxmapper
- *
eap8-apache-sshd
- *
eap8-cryptacular
- *
eap8-elytron-web
- *
eap8-eventstream
- *
eap8-fastinfoset
- *
eap8-hal-console
- *
eap8-ironjacamar
- *
eap8-jboss-stdio
- *
eap8-jbossws-api
- *
eap8-jbossws-cxf
- *
eap8-jbossws-spi
- *
eap8-jgroups-aws
- *
eap8-lucene-solr
- *
eap8-mod_cluster
- *
eap8-protoparser
- *
eap8-protostream
- *
eap8-aws-java-sdk
- *
eap8-bouncycastle
- *
eap8-eclipse-jgit
- *
eap8-jackson-core
- *
eap8-jakarta-json
- *
eap8-jakarta-mail
- *
eap8-pem-keystore
- *
eap8-plexus-utils
- *
eap8-resilience4j
- *
eap8-xml-security
- *
eap8-aesh-readline
- *
eap8-apache-mime4j
- *
eap8-azure-storage
- *
eap8-elasticsearch
- *
eap8-jboss-logging
- *
eap8-jboss-modules
- *
eap8-jboss-threads
- *
eap8-jgroups-azure
- *
eap8-objectweb-asm
- *
eap8-woodstox-core
- *
eap8-artemis-native
- *
eap8-fge-msg-simple
- *
eap8-java-classmate
- *
eap8-jboss-metadata
- *
eap8-jboss-remoting
- *
eap8-jboss-weld-api
- *
eap8-jbossws-common
- *
eap8-wildfly-common
- *
eap8-aesh-extensions
- *
eap8-guava-libraries
- *
eap8-jakarta-ejb-api
- *
eap8-jakarta-jms-api
- *
eap8-javaee-jpa-spec
- *
eap8-jboss-xnio-base
- *
eap8-nimbus-jose-jwt
- *
eap8-resteasy-spring
- *
eap8-undertow-jastow
- *
eap8-wildfly-elytron
- *
eap8-wildfly-openssl
- *
eap8-activemq-artemis
- *
eap8-angus-activation
- *
eap8-hibernate-search
- *
eap8-jackson-databind
- *
eap8-jakarta-json-api
- *
eap8-jboss-ejb-client
- *
eap8-jboss-genericjms
- *
eap8-jboss-invocation
- *
eap8-jboss-logmanager
- *
eap8-jcip-annotations
- *
eap8-reactive-streams
- *
eap8-reactivex-rxjava
- *
eap8-wildfly-javadocs
- *
eap8-apache-commons-io
- *
eap8-jackson-coreutils
- *
eap8-jakarta-batch-api
- *
eap8-jakarta-websocket
- *
eap8-jakarta-ws-rs-api
- *
eap8-jboss-cert-helper
- *
eap8-jboss-iiop-client
- *
eap8-jboss-marshalling
- *
eap8-jboss-openjdk-orb
- *
eap8-jul-to-slf4j-stub
- *
eap8-reactivex-rxjava2
- *
eap8-wildfly-discovery
- *
eap8-apache-commons-cli
- *
eap8-jakarta-activation
- *
eap8-javapackages-tools
- *
eap8-jboss-common-beans
- *
eap8-jboss-ejb3-ext-api
- *
eap8-jboss-remoting-jmx
- *
eap8-jgroups-kubernetes
- *
eap8-sun-istack-commons
- *
eap8-wildfly-clustering
- *
eap8-wildfly-elytron-ee
- *
eap8-apache-commons-lang
- *
eap8-guava-failureaccess
- *
eap8-hibernate-validator
- *
eap8-httpcomponents-core
- *
eap8-jackson-annotations
- *
eap8-jakarta-servlet-api
- *
eap8-resteasy-extensions
- *
eap8-wildfly-http-client
- *
eap8-apache-commons-codec
- *
eap8-apache-cxf-xjc-utils
- *
eap8-insights-java-client
- *
eap8-jackson-modules-base
- *
eap8-jakarta-resource-api
- *
eap8-jakarta-xml-bind-api
- *
eap8-jbossws-common-tools
- *
eap8-netty-xnio-transport
- *
eap8-ws-commons-XmlSchema
- *
eap8-xml-commons-resolver
- *
io.undertow.jastow-jastow
eap8-httpcomponents-client
- *
eap8-jackson-modules-java8
- *
eap8-jboss-classfilewriter
- *
eap8-jboss-el-api_5.0_spec
- *
eap8-jboss-transaction-spi
- *
eap8-wildfly-client-config
- *
eap8-wildfly-naming-client
- *
eap8-jakarta-annotation-api
- *
eap8-jakarta-validation-api
- *
eap8-slf4j-jboss-logmanager
- *
eap8-activemq-artemis-native
- *
eap8-eap-product-conf-parent
- *
eap8-jackson-jaxrs-providers
- *
eap8-jakarta-interceptor-api
- *
eap8-jakarta-servlet-jsp-api
- *
eap8-jakarta-transaction-api
- *
eap8-javaee-security-soteria
- *
eap8-jboss-saaj-api_3.0_spec
- *
eap8-log4j2-jboss-logmanager
- *
eap8-shibboleth-java-support
- *
eap8-apache-commons-beanutils
- *
eap8-installation-manager-api
- *
eap8-jackson-dataformats-text
- *
eap8-jakarta-authorization-api
- *
eap8-apache-commons-collections
- *
eap8-httpcomponents-asyncclient
- *
eap8-jakarta-authentication-api
- *
eap8-wildfly-transaction-client
- *
eap8-artemis-wildfly-integration
- *
eap8-wildfly-openssl-el10-x86_64
- *
eap8-jakarta-servlet-jsp-jstl-api
- *
eap8-netty-transport-native-epoll
- *
eap8-commons-logging-jboss-logging
- *
eap8-hibernate-commons-annotations
- *
eap8-jakarta-enterprise-concurrent
- *
eap8-jakarta-enterprise-lang-model
- *
eap8-jbossws-jaxws-undertow-httpspi
- *
eap8-jakarta-security-enterprise-api
- *
eap8-jakarta-enterprise-concurrent-api
- *
eap8-jboss-jakarta-xml-ws-api_4.0_spec
- *
jboss-eap-7/eap74-els-openjdk8-openshift-rhel8
jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8
eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8
eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8