جزئیات آسیب‌پذیری
CVE-2026-89058
Red Hat Build of KeycloakRed Hat Certificate System 10Red Hat Certificate System 11Red Hat Fuse 7Red Hat JBoss Enterprise Application Platform 7Red Hat JBoss Enterprise Application Platform Expansion Pack
Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config
CVSS 3.1
7.4بالا
شرح رسمی (انگلیسی)
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.4بالا | 3.1 | CVEProject cvelistV5 (CNA) (redhat) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Keycloak | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Certificate System 10 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Certificate System 11 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Fuse 7 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Fuse 7 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Single Sign-On 7 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apicurio Registry 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Debezium 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | — | v < 6.2.19.Final | CVEProject cvelistV5 (CNA) |
| Red Hat | — | 7.0.0.Alpha1 ≤ v < 7.0.5.Final | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱۴- https://access.redhat.com/errata/RHSA-2026:83082 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:83520 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:83670 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:85234 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:92408 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95221 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95466 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95504 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95505 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95887 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-89058 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2519775 issue-trackingx_refsource_REDHAT
- https://github.com/resteasy/resteasy/commit/efeb2b7
- https://github.com/resteasy/resteasy/security/advisories/GHSA-972r-f3fv-whm3
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۶/۲۷
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۸/۱۵
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- redhat
پیش‌بینی بهره‌برداری (EPSS)
۰٫۴۷٪
احتمال بهره‌برداری در ۳۰ روز
۴۱٫۱٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- اثبات مفهوم
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-346Origin Validation Error
- CWE-942Permissive Cross-domain Policy with Untrusted Domains