Read the docs
TI-2015-05661 Aliases CVE-2015-6748GHSA-48rh-qgjr-xfj6

Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02195 82nd percentileScored 2026-11-07
Fix Partial org.jsoup:jsoup (Maven): 1.8.3Red Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.jsoup:jsoup (Maven)1.6.0 to before 1.8.31.8.3Patch availableGHSA-48rh-qgjr-xfj6
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.jsoup:jsoup (Maven) Vendor— Affected 1.6.0 to before 1.8.3 Fixed in 1.8.3 Patch available GHSA-48rh-qgjr-xfj6

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:jsoup:jsoup:*:*:*:*:*:*:*:*1.6.0 to before 1.8.3VulnerableJsoup
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
  • cpe:2.3:a:jsoup:jsoup:*:*:*:*:*:*:*:* Versions 1.6.0 to before 1.8.3 Vulnerable ·Jsoup
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-48rh-qgjr-xfj6 org.jsoup:jsoup (Maven) Fixed in 1.8.3 Advisory →

Red Hat 2 advisories

  • RHSA-2015:2559 Released 2015-12-07 · Red Hat rating Critical
    Red Hat JBoss BRMS 6.2.0 update
    • Red Hat JBoss BRMS 6.2
  • RHSA-2015:2560 Released 2015-12-07 · Red Hat rating Critical
    Red Hat JBoss BPM Suite 6.2.0 update
    • Red Hat JBoss BPMS 6.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix yet
Red Hat JBoss Fuse 6AffectedNo fix planned: Will not fix
Red Hat JBoss BPMS 6.2Fixed RHSA-2015:2560
Red Hat JBoss BRMS 6.2Fixed RHSA-2015:2559

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-6748
  2. 2026-10-03 Alias added: GHSA-48rh-qgjr-xfj6
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 1

Advisory 2

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences