CVE-2015-6748: XSS
Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.
Other sources
jsoup is vulnerable to cross-site scripting, caused by improper validation of user-supplied input when handling tags without a closing > when reaching EOF. A remote attacker could exploit this vulnerability using specially crafted HTML to execute script in a victim's Web browser. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
We have identified a small vulnerability in Hibernate Validator which is used in at least WildFly and JBoss EAP. https://issues.jboss.org/browse/WFLY-5223 [Open URL] https://hibernate.atlassian.net/browse/HV-1012 [Open URL] The vulnerability is in the dependency jsoup. Our understanding is that the likely vector OS that : - an app developer guards a field as safe html via Hibernate Validator - a malicious user sends a non safe html snippet not properly detected - the application then uses the html believing it is safe.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-6748?
CVE-2015-6748 is classified as a medium severity cross-site scripting (XSS) vulnerability in jsoup before version 1.8.3.
How do I fix CVE-2015-6748?
To fix CVE-2015-6748, upgrade jsoup to version 1.8.3 or later.
Which versions of jsoup are affected by CVE-2015-6748?
CVE-2015-6748 affects all jsoup versions from 1.6.0 up to but not including 1.8.3.
Is CVE-2015-6748 relevant to JBoss EAP and WildFly?
Yes, CVE-2015-6748 is relevant to applications that use jsoup, such as JBoss EAP and WildFly.
What type of vulnerability is CVE-2015-6748?
CVE-2015-6748 is a cross-site scripting (XSS) vulnerability.