Cross-Site Scripting Vulnerability in Jastow by Red Hat
CVE-2025-12799

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Jboss Enterprise Application Platform 7
Red Hat Jboss Enterprise Application Platform 8
Red Hat Jboss Enterprise Application Platform Expansion Pack
Red Hat Single Sign-on 7
Vendor
CVE Published:
7 July 2026

What is CVE-2025-12799?

A vulnerability exists in Jastow that exposes systems to Cross-Site Scripting (XSS) attacks. This flaw arises when a specific configuration allows unescaped characters within URLs when integrated with Undertow and Jastow. When this configuration is mismanaged, it can lead to improper handling of input data, opening the door for attackers to inject malicious scripts, potentially compromising the integrity and confidentiality of the server.

References

https://access.redhat.com/security/cve/CVE-2025-12799
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2413071
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.