6.5
Medium
CVE-2023-5675 Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
Description
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat build of Quarkus 2.13.9.Final 2.13 | earliest → < 2.13.9.Final-redhat-00003 | 2.13.9.Final-redhat-00003 |
| Red Hat build of Quarkus 3.2.9.Final 3.2 | earliest → < 3.2.9.Final-redhat-00003 | 3.2.9.Final-redhat-00003 |
| A-MQ Clients 2 | Versions not published | |
| Cryostat 2 | Versions not published | |
| OpenShift Serverless | Versions not published | |
| Red Hat build of Apicurio Registry 2 | Versions not published | |
| Red Hat build of OptaPlanner 8 | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat Integration Camel K 1 | Versions not published |
Show the 3 other branches Hide the 3 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Integration Camel Quarkus 2 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat Process Automation 7 | Versions not published |
References
- RHSA-2024:0494 access.redhat.com
- RHSA-2024:0495 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2245197 bugzilla.redhat.com
Timeline
- Published
- Last modified