CVE-2025-12799
CVE-2025-12799: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium6.5
Medium [CVE-2025-12799] Jastow Cross-Site Scripting attack due to unsanitized URI
CVE-2025-12799Source published Source updated
A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters in URL with embedded Undertow and Jastow, a server might be vulnerable to improper input handling. Exploitation requires a specific, non-default configuration, limiting its applicability in typical deployments. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N). Weakness: CWE-79. Affected Red Hat products: Red Hat JBoss Enterprise Application Platform 8.1.7.GA; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9; Red Hat JBoss Enterprise Application Platform 7; Red…
- Affected products in this advisory
- Red Hat JBoss Enterprise Application Platform 8.1.7.GA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
3 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- io.undertow.jastow/jastow:2.2.9.SP1-redhat-00001
- eap8-0:1-9.el10eap
- eap8-activemq-artemis-0:2.40.0-7.redhat_00015.1.el10eap
- eap8-activemq-artemis-native-1:2.0.0-2.redhat_00005.1.el10eap
40 more entries in the full advisory.
- Mitigation guidance
- It is possible to contruct successful attack vector if and only if customer or client is using embedded Undertow and Jastow together in their application and the following conditions are met: * Undertow was configured with UndertowOptions.ALLOW_UNESCAPED_CHARACTERS_IN_URL set to 'true' value * DeploymentInfo configured with setEscapeErrorMessage(true) method was passed to Undertow's Servlet Container instance
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.