CVE-2016-6348 — RESTEasy: Use of JacksonJsonpInterceptor in RESTEasy can lead to Cross Site Script Inclusion attack

MEDIUM

RESTEasy: Use of JacksonJsonpInterceptor in RESTEasy can lead to Cross Site Script Inclusion attack

Published Apr 12, 2017

6.1

MEDIUM

CVSS 3.0

EPSS 1.57%

JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack.

Product	Package	State	Advisory
Red Hat BPM Suite 6	Build and Assembly	Will not fix	n/a
Red Hat Enterprise Linux 7	resteasy-base	Fix deferred	n/a
Red Hat Enterprise Virtualization 3	vdsm-jsonrpc-java	Under investigation	n/a
Red Hat JBoss BRMS 5	security	Will not fix	n/a
Red Hat JBoss BRMS 6	Build and Assembly	Will not fix	n/a
Red Hat JBoss Data Grid 6	build	Not affected	n/a
Red Hat JBoss Data Grid 7	resteasy	Affected	n/a
Red Hat JBoss Data Virtualization 6	Productization	Will not fix	n/a
Red Hat JBoss Enterprise Application Platform 5	jbossas	Will not fix	n/a
Red Hat JBoss Enterprise Application Platform 6	resteasy	Will not fix	n/a
Red Hat JBoss Enterprise Application Platform 7	rest	Will not fix	n/a
Red Hat JBoss Fuse 6	SwitchYard	Under investigation	n/a
Red Hat JBoss Fuse Service Works 6	SwitchYard	Will not fix	n/a
Red Hat JBoss Operations Network 3	rest	Will not fix	n/a
Red Hat JBoss Portal 6	Requirements	Not affected	n/a
Red Hat JBoss SOA Platform 5	security	Will not fix	n/a
Red Hat Satellite 6	Security	Not affected	n/a
Red Hat Single Sign-On 7	core	Not affected	n/a
Red Hat Subscription Asset Manager	katello	Under investigation	n/a

No remediation recorded yet.

1.57% 0.01574

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01574

2022–2026

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.57% (0.01574)	74.54th	v5 (v2026.06.15)
Jun 15, 2026	1.31% (0.01315)	66.90th	v5 (v2026.06.15)
Mar 17, 2025	0.20% (0.00201)	40.20th	v4 (v2025.03.14)
Dec 12, 2024	0.13% (0.00131)	49.71th	v3 (v2023.03.01)
Dec 24, 2023	0.13% (0.00131)	47.93th	v3 (v2023.03.01)
Mar 7, 2023	0.12% (0.00116)	43.76th	v3 (v2023.03.01)
Mar 6, 2023	1.05% (0.01055)	52.13th	v2 (v2022.01.01)
Sep 17, 2022	1.05% (0.01055)	50.47th	v2 (v2022.01.01)
Apr 1, 2022	1.05% (0.01055)	48.43th	v2 (v2022.01.01)
Feb 4, 2022	1.05% (0.01055)	27.52th	v2 (v2022.01.01)

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2016-6348		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1372129		x_refsource_CONFIRMIssue Tracking
https://github.com/advisories/GHSA-9xfc-j5mf-9w5p		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-6348
https://www.cve.org/CVERecord?id=CVE-2016-6348