Metrics
Affected Vendors & Products
No advisories yet.
Solution
No solution given by the vendor.
Workaround
It is possible to contruct successful attack vector if and only if customer or client is using embedded Undertow and Jastow together in their application and the following conditions are met: * Undertow was configured with UndertowOptions.ALLOW_UNESCAPED_CHARACTERS_IN_URL set to 'true' value * DeploymentInfo configured with setEscapeErrorMessage(true) method was passed to Undertow's Servlet Container instance
Thu, 09 Jul 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 08 Jul 2026 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Tue, 07 Jul 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 |
|
| References |
|
Tue, 07 Jul 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters in URL with embedded Undertow and Jastow, a server might be vulnerable to improper input handling. | |
| Title | Jastow: jastow cross-site scripting attack due to unsanitized uri | |
| First Time appeared |
Redhat
Redhat jboss Enterprise Application Platform Redhat jbosseapxp Redhat red Hat Single Sign On |
|
| Weaknesses | CWE-79 | |
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jbosseapxp cpe:/a:redhat:red_hat_single_sign_on:7 |
|
| Vendors & Products |
Redhat
Redhat jboss Enterprise Application Platform Redhat jbosseapxp Redhat red Hat Single Sign On |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-07-29T16:24:51.191Z
Reserved: 2025-11-06T11:15:12.378Z
Link: CVE-2025-12799
Updated: 2026-07-09T13:34:25.471Z
Status : Awaiting Analysis
Published: 2026-07-07T17:16:34.640
Modified: 2026-07-29T17:16:49.140
Link: CVE-2025-12799
OpenCVE Enrichment
Updated: 2026-07-31T14:30:04Z