https://bugzilla.redhat.com/show_bug.cgi?id=1942819
Bug ID: 1942819
Summary: RESTEasy: PathParam in RESTEasy can lead to a
reflected XSS attack
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: jwon(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
alee(a)redhat.com, alexander.m.scheel(a)gmail.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bgeorges(a)redhat.com, bibryam(a)redhat.com,
bkearney(a)redhat.com, bmaxwell(a)redhat.com,
brian.stansberry(a)redhat.com, btotty(a)redhat.com,
cdewolf(a)redhat.com, cfu(a)redhat.com,
chazlett(a)redhat.com, clement.escoffier(a)redhat.com,
dandread(a)redhat.com, darran.lofthouse(a)redhat.com,
dchen(a)redhat.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
edewata(a)redhat.com, eleandro(a)redhat.com,
eric.wittmann(a)redhat.com, fjuma(a)redhat.com,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
gsmet(a)redhat.com, hamadhan(a)redhat.com,
hbraun(a)redhat.com, hhudgeon(a)redhat.com,
iweiss(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jmagne(a)redhat.com, jochrist(a)redhat.com,
jpallich(a)redhat.com, jperkins(a)redhat.com,
jwon(a)redhat.com, kaycoth(a)redhat.com,
krathod(a)redhat.com, kwills(a)redhat.com,
lgao(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com,
mkdineshprasanth(a)gmail.com, mmccune(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, nmoumoul(a)redhat.com,
nwallace(a)redhat.com, pantinor(a)redhat.com,
pcreech(a)redhat.com, peholase(a)redhat.com,
pgallagh(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, probinso(a)redhat.com,
puntogil(a)libero.it, rchan(a)redhat.com,
rguimara(a)redhat.com, rhcs-maint(a)redhat.com,
rjerrido(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
sbiarozk(a)redhat.com, sdouglas(a)redhat.com,
smaestri(a)redhat.com, sokeeffe(a)redhat.com,
tbrisker(a)redhat.com, tom.jenkinson(a)redhat.com,
weli(a)redhat.com, yborgess(a)redhat.com
Blocks: 1941409
Target Milestone: ---
Classification: Other
A cross-site scripting (XSS) flaw was found in RESTEasy, where it did not
properly handle URL encoding when calling @javax.ws.rs.PathParam without any
@Produces MediaType. An attacker could use this flaw to launch a reflected XSS
attack.
--
You are receiving this mail because:
You are on the CC list for the bug.