CVE-2020-10688

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	RESTEasy	resteasy 3.11.1.Final, resteasy 4.5.3.Final

References

https://bugzilla.redhat.com/show_bug.cgi?id=1814974Issue Tracking, Patch, Vendor Advisory
https://github.com/quarkusio/quarkus/issues/7248Exploit, Issue Tracking, Third Party Advisory
https://issues.redhat.com/browse/RESTEASY-2519Issue Tracking, Permissions Required, Vendor Advisory
https://security.netapp.com/advisory/ntap-20210706-0008/Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1814974Issue Tracking, Patch, Vendor Advisory
https://github.com/quarkusio/quarkus/issues/7248Exploit, Issue Tracking, Third Party Advisory
https://issues.redhat.com/browse/RESTEASY-2519Issue Tracking, Permissions Required, Vendor Advisory
https://security.netapp.com/advisory/ntap-20210706-0008/Third Party Advisory

Timeline

Published: May 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-106896.8A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An authenticated user CVE-2020-10698.8A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web CVE-2020-106906.4There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource dea CVE-2020-106915.2An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. Whe CVE-2020-106935.3A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to CVE-2020-106957.8An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access to the container can CVE-2020-106968.8A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious CVE-2020-106974.4A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is accessed via TCP. An attacker can take advantage CVE-2020-106983.3A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run fr CVE-2020-106997.8A flaw was found in Linux, in targetcli-fb versions 2.1.50 and 2.1.51 where the socket used by targetclid was world-writable. If a system en CVE-2020-10707.8An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system CVE-2020-107005.3A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A m