CVE-2016-6347: XSS
Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Other sources
It was found that the default exception handler in RESTEasy did not properly validate user input. An attacker could use this flaw to launch a relected XSS attack.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6347?
CVE-2016-6347 is classified as a moderate severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2016-6347?
To fix CVE-2016-6347, upgrade RESTEasy to versions 3.1.0 or later, or to 3.0.20 if applicable.
What types of attacks are possible with CVE-2016-6347?
CVE-2016-6347 allows remote attackers to inject arbitrary web scripts or HTML through the default exception handler.
Which versions of RESTEasy are affected by CVE-2016-6347?
RESTEasy versions up to and including 3.1.0 and 3.0.20 are affected by CVE-2016-6347.
What is the impact of exploiting CVE-2016-6347?
Exploiting CVE-2016-6347 can lead to unauthorized access to sensitive data and session hijacking.