7.4
High
CVE-2023-6394 A flaw was found in Quarkus
Description
A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat build of Quarkus 2.13.9.Final 2.13 | earliest → < 2.13.9.Final-redhat-00002 | 2.13.9.Final-redhat-00002 |
| Red Hat build of Quarkus 3.2.9.Final 3.2 | earliest → < 3.2.9.Final-redhat-00002 | 3.2.9.Final-redhat-00002 |
| Red Hat build of Quarkus 2.13.9 | Versions not published | |
| Red Hat build of Quarkus | Versions not published |
References
- RHSA-2023:7612 access.redhat.com
- RHSA-2023:7700 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2252197 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat build of Quarkus 2.13.9.Final
The 4 CVEs of Red Hat build of Quarkus 2.13.9.Final →
CVE-2023-5675
Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
6.5
Medium
CVE-2023-6267
Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.
8.6
High
CVE-2023-6393
A flaw was found in the Quarkus Cache Runtime
5.3
Medium