CVE-2025-12799
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A flaw was found in Jastow that makes it vulnerable to Cross-Site Scripting (XSS) attacks. If a specific configuration combination allows unescaped characters in the URL with embedded Undertow and Jastow, the server may be exposed to improper input handling.
Risk Assessment
An attacker can inject malicious scripts into the page, potentially leading to user session theft, redirects to malicious sites, or theft of sensitive data.
Recommendation
It is recommended to immediately update Jastow to the latest version and review the Undertow configuration to eliminate the possibility of using unescaped characters in the URL.
Original NVD description (English source)
A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters in URL with embedded Undertow and Jastow, a server might be vulnerable to improper input handling.