This vulnerability affects Red Hat JBoss Enterprise Application Platform 7 through a flaw in Jastow, which is vulnerable to Cross-Site Scripting (XSS) attacks. The vulnerability occurs when configurations permit unescaped characters in URLs handled by Undertow and Jastow, resulting in improper input neutralization during web page generation. The CVSS 3.1 base score is 6.5, indicating medium severity, with network attack vector, high attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity but not availability. The vendor advisory does not specify affected versions or remediation status.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to unauthorized disclosure of information and modification of data. The CVSS vector indicates limited confidentiality and high integrity impact, with no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2025-12799 for current remediation guidance. Until an official fix is available, review and adjust configurations to avoid allowing unescaped characters in URLs processed by Undertow and Jastow components. Monitor Red Hat communications for updates on patches or workarounds.