REDHAT-BUG-2405789: XSS
In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2405789?
The severity of REDHAT-BUG-2405789 is considered to be high due to the potential for attackers to exploit improper file handling.
How do I fix REDHAT-BUG-2405789?
To fix REDHAT-BUG-2405789, it is recommended to upgrade to a version of Eclipse Vert.x that is not affected, specifically beyond 4.5.21 or 5.0.4.
What versions of Eclipse Vert.x are affected by REDHAT-BUG-2405789?
Eclipse Vert.x versions from 4.0.0 to 4.5.21 and from 5.0.0 to 5.0.4 are affected by REDHAT-BUG-2405789.
What is the main vulnerability described in REDHAT-BUG-2405789?
The main vulnerability in REDHAT-BUG-2405789 involves improper escaping of file and directory names in generated HTML when directory listing is enabled.
Can an attacker exploit REDHAT-BUG-2405789 remotely?
Yes, an attacker with access to create or rename files or directories in a served path can exploit REDHAT-BUG-2405789 remotely.