Executive brief
A security vulnerability has been identified in Jastow, a component used within Red Hat JBoss Enterprise Application Platform for processing JSP pages. When configured in a specific way with the Undertow web server, the system fails to properly clean web addresses (URLs) before displaying them. This could allow an attacker to perform a Cross-Site Scripting (XSS) attack, potentially leading to unauthorized actions being performed in a user's browser or the theft of sensitive session information.
Technical details
A Cross-Site Scripting (XSS) vulnerability (CWE-79) exists in Jastow due to improper neutralization of input during web page generation. The flaw is triggered when Jastow is used in conjunction with an embedded Undertow server configured to allow unescaped characters in URLs. An attacker can exploit this by crafting a malicious URI containing unsanitized scripts. While the attack vector is network-based, the CVSS assessment indicates high complexity (AC:H), likely due to the specific configuration requirements involving both Jastow and Undertow settings. Successful exploitation allows for unauthorized script execution in the context of the user's session.
Affected products
- Red Hat Jastow 7.0.0
- Red Hat JBoss Enterprise Application Platform 7 7.0.0
Timeline
- 2025-11-06: other: Vulnerability reported to Red Hat Bugzilla
- 2026-07-07: advisory: CVE published by Red Hat and NVD