CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2021-20293
Medium (6.1). EPSS 0.9% chance of exploitation in the next 30 days.
A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected XSS attack. The highest threat from this vulnerability is to data confidentiality and integrity.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-11-01)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- netapp:oncommand_insight
- redhat:resteasy
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5h26-c766-g93v | Maven | org.jboss.resteasy:resteasy-bom | <=4.6.0.Final | no fix published |
| GHSA-5h26-c766-g93v | Maven | org.jboss.resteasy:resteasy-core | <=4.6.0.Final | no fix published |