CVE-2025-12799: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Red Hat Red Hat JBoss Enterprise Application Platform 8.1
A Cross-Site Scripting (XSS) vulnerability (CVE-2025-12799) exists in the Jastow component of Red Hat JBoss Enterprise Application Platform 8 due to an unsanitized URI. This vulnerability is addressed in the Red Hat JBoss Enterprise Application Platform 8.1.7 update, which replaces version 8.1.6 and includes this security fix along with other enhancements. The vulnerability is rated as having moderate security impact by Red Hat Product Security.
AI Analysis
Technical Summary
Red Hat JBoss Enterprise Application Platform 8, based on the WildFly runtime, contains a Cross-Site Scripting vulnerability in the io.undertow.jastow-jastow component caused by an unsanitized URI (CVE-2025-12799). This vulnerability allows potential injection of malicious scripts via crafted URIs. Red Hat released version 8.1.7 of the platform to address this issue by upgrading the Jastow component and other dependencies. The update is a replacement for version 8.1.6 and includes multiple bug fixes and enhancements. No CVSS score is provided in the advisory, but the severity is classified as moderate.
Potential Impact
The vulnerability allows Cross-Site Scripting attacks due to improper sanitization of URIs in the Jastow component. This can lead to execution of arbitrary scripts in the context of the affected application, potentially impacting confidentiality and integrity of user interactions. The advisory rates the security impact as moderate, indicating a significant but not critical risk.
Mitigation Recommendations
A security update is available in Red Hat JBoss Enterprise Application Platform version 8.1.7, which addresses this vulnerability by upgrading the Jastow component and other related dependencies. Users should apply this update after ensuring all previously released errata are applied and backing up their existing installations. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258. No indication of alternative mitigations or that no action is required is provided, so applying the official update is recommended.
CVE-2025-12799: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Red Hat Red Hat JBoss Enterprise Application Platform 8.1
Description
A Cross-Site Scripting (XSS) vulnerability (CVE-2025-12799) exists in the Jastow component of Red Hat JBoss Enterprise Application Platform 8 due to an unsanitized URI. This vulnerability is addressed in the Red Hat JBoss Enterprise Application Platform 8.1.7 update, which replaces version 8.1.6 and includes this security fix along with other enhancements. The vulnerability is rated as having moderate security impact by Red Hat Product Security.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat JBoss Enterprise Application Platform 8, based on the WildFly runtime, contains a Cross-Site Scripting vulnerability in the io.undertow.jastow-jastow component caused by an unsanitized URI (CVE-2025-12799). This vulnerability allows potential injection of malicious scripts via crafted URIs. Red Hat released version 8.1.7 of the platform to address this issue by upgrading the Jastow component and other dependencies. The update is a replacement for version 8.1.6 and includes multiple bug fixes and enhancements. No CVSS score is provided in the advisory, but the severity is classified as moderate.
Potential Impact
The vulnerability allows Cross-Site Scripting attacks due to improper sanitization of URIs in the Jastow component. This can lead to execution of arbitrary scripts in the context of the affected application, potentially impacting confidentiality and integrity of user interactions. The advisory rates the security impact as moderate, indicating a significant but not critical risk.
Mitigation Recommendations
A security update is available in Red Hat JBoss Enterprise Application Platform version 8.1.7, which addresses this vulnerability by upgrading the Jastow component and other related dependencies. Users should apply this update after ensuring all previously released errata are applied and backing up their existing installations. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258. No indication of alternative mitigations or that no action is required is provided, so applying the official update is recommended.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:36345
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a4e4ee3c9d9e3dbe32896a1
Added to database: 07/08/2026, 13:21:39 UTC
Last enriched: 07/08/2026, 13:38:13 UTC
Last updated: 07/09/2026, 03:35:37 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.