未評価
A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL e...
CVE-2020-10688
SecPulse初出
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2020-10688 resteasy3.0 修正版: 3.0.26-4
- Ubuntu UBUNTU-CVE-2020-10688 resteasy 修正版: 3.0.6-3ubuntu0.1~esm1
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory security.netapp.com
- patch bugzilla.redhat.com
- report github.com
- report issues.redhat.com