CVE-2021-20293: 
Java vulnerability analysis and mitigation

A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions up to 4.6.0.Final. The vulnerability exists in the handling of URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType (NVD, Red Hat Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The flaw is specifically related to improper URL encoding handling in the PathParam functionality when no MediaType is specified (NVD).

The successful exploitation of this vulnerability could lead to disclosure of sensitive information or addition or modification of data through reflected XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity (NetApp Advisory).

The vulnerability requires no privileges (PR:N) but does require user interaction (UI:R) to exploit. The attack complexity is considered low (AC:L), and the attack vector is network-based (AV:N) (NVD).

The vulnerability has been fixed in RESTEasy version 4.6.0.Final. Users are advised to upgrade to this version or later to address the security issue. No temporary workarounds have been identified (Red Hat Advisory).