Skip to content
fr Sign in
8.6 High

CVE-2023-6267 Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.

Description

A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
Low
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High

Affected products and versions

Product Affected versions Fixed in
Red Hat build of Quarkus 2.13.9.Final 2.13 earliest → < 2.13.9.Final-redhat-00003 2.13.9.Final-redhat-00003
Red Hat build of Quarkus 3.2.9.Final 3.2 earliest → < 3.2.9.Final-redhat-00003 3.2.9.Final-redhat-00003
Red Hat build of OptaPlanner 8 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat Integration Camel K 1 Versions not published
Red Hat Integration Camel Quarkus 2 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat build of Quarkus 2.13.9.Final

The 4 CVEs of Red Hat build of Quarkus 2.13.9.Final →
CVE-2023-5675 Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used. 6.5 Medium CVE-2023-6394 A flaw was found in Quarkus 7.4 High CVE-2023-6393 A flaw was found in the Quarkus Cache Runtime 5.3 Medium
Track this CVE