Read the docs
TI-2020-08591 Aliases CVE-2020-10688GHSA-29qj-rvv6-qrmv

Cross-site scripting in RESTEasy

Priority LOW 30CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 8 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.

Why it matters now

EPSS 0.01388 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.jboss.resteasy:resteasy-bom (Maven): 3.11.1.Final, 4.5.3.Finalorg.jboss.resteasy:resteasy-core (Maven): 3.11.1.Final, 4.5.3.FinalRed Hat: 8 advisoriesRed Hat: 8 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—RESTEasyresteasy 3.11.1.Final, resteasy 4.5.3.Final—No fix listedCNA
—org.jboss.resteasy:resteasy-bom (Maven)before 3.11.1.Final3.11.1.FinalPatch availableGHSA-29qj-rvv6-qrmv
—org.jboss.resteasy:resteasy-bom (Maven)4.0.0 to before 4.5.3.Final4.5.3.FinalPatch availableGHSA-29qj-rvv6-qrmv
—org.jboss.resteasy:resteasy-core (Maven)before 3.11.1.Final3.11.1.FinalPatch availableGHSA-29qj-rvv6-qrmv
—org.jboss.resteasy:resteasy-core (Maven)4.0.0 to before 4.5.3.Final4.5.3.FinalPatch availableGHSA-29qj-rvv6-qrmv
  • RESTEasy Vendor— Affected resteasy 3.11.1.Final, resteasy 4.5.3.Final Fixed in — No fix listed CNA
  • org.jboss.resteasy:resteasy-bom (Maven) Vendor— Affected before 3.11.1.Final Fixed in 3.11.1.Final Patch available GHSA-29qj-rvv6-qrmv
  • org.jboss.resteasy:resteasy-bom (Maven) Vendor— Affected 4.0.0 to before 4.5.3.Final Fixed in 4.5.3.Final Patch available GHSA-29qj-rvv6-qrmv
  • org.jboss.resteasy:resteasy-core (Maven) Vendor— Affected before 3.11.1.Final Fixed in 3.11.1.Final Patch available GHSA-29qj-rvv6-qrmv
  • org.jboss.resteasy:resteasy-core (Maven) Vendor— Affected 4.0.0 to before 4.5.3.Final Fixed in 4.5.3.Final Patch available GHSA-29qj-rvv6-qrmv

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:*before 3.11.1; 4.5.0 to before 4.5.3VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
  • cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:* Versions before 3.11.1; 4.5.0 to before 4.5.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-29qj-rvv6-qrmv org.jboss.resteasy:resteasy-bom (Maven) Fixed in 3.11.1.Final Advisory →
  • Fix · GHSA-29qj-rvv6-qrmv org.jboss.resteasy:resteasy-bom (Maven) Fixed in 4.5.3.Final Advisory →
  • Fix · GHSA-29qj-rvv6-qrmv org.jboss.resteasy:resteasy-core (Maven) Fixed in 3.11.1.Final Advisory →
  • Fix · GHSA-29qj-rvv6-qrmv org.jboss.resteasy:resteasy-core (Maven) Fixed in 4.5.3.Final Advisory →

Red Hat 8 advisories

  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2020:3806 Released 2020-09-23 · Red Hat rating Important
    Red Hat support for Spring Boot 2.2.6.SP2 security update
    • Red Hat Runtimes Spring Boot 2.2.6
  • RHSA-2020:2905 Released 2020-07-23 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.0 security and bug fix update
    • Text-Only RHOAR
Show 5 more Red Hat advisories
  • RHSA-2020:2511 Released 2020-06-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el6eap +47
  • RHSA-2020:2512 Released 2020-06-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el7eap +47
  • RHSA-2020:2513 Released 2020-06-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el8eap +47
  • RHSA-2020:2515 Released 2020-06-10 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2020:2333 Released 2020-05-28 · Red Hat rating Important
    EAP Continuous Delivery Technical Preview Release 19 security update
    • EAP-CD 19 Tech Preview

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat support for Spring BootAffectedNo fix yet
EAP-CD 19 Tech PreviewFixed RHSA-2020:2333
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2020:2513
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2020:2511
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2020:2512
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2020:2515
Red Hat Runtimes Spring Boot 2.2.6Fixed RHSA-2020:3806
Text-Only RHOARFixed RHSA-2020:2905

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10688
  2. 2026-10-03 Alias added: GHSA-29qj-rvv6-qrmv
  3. 2026-11-05 Fix available: Red Hat JBoss Enterprise Application Platform 7 · Red Hat

References

Exploit 1

Patch 1

Advisory 3

Other 1

  • TI-2016-03813 Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-01295 The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows… KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-03645 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
  • TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2025-11507 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVSS 3.1CRITICAL 9.6
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences