7.4
Élevée
CVE-2023-6394 A flaw was found in Quarkus
Description
A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat build of Quarkus 2.13.9.Final 2.13 | premières → < 2.13.9.Final-redhat-00002 | 2.13.9.Final-redhat-00002 |
| Red Hat build of Quarkus 3.2.9.Final 3.2 | premières → < 3.2.9.Final-redhat-00002 | 3.2.9.Final-redhat-00002 |
| Red Hat build of Quarkus 2.13.9 | Versions non publiées | |
| Red Hat build of Quarkus | Versions non publiées |
Références
- RHSA-2023:7612 access.redhat.com
- RHSA-2023:7700 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2252197 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat build of Quarkus 2.13.9.Final
Les 4 CVE de Red Hat build of Quarkus 2.13.9.Final →
CVE-2023-5675
Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
6.5
Moyenne
CVE-2023-6267
Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.
8.6
Élevée
CVE-2023-6393
A flaw was found in the Quarkus Cache Runtime
5.3
Moyenne