CVEvulnerability

CVE-2023-4853

8.1 HIGH Published 2023-09-20 Modified 2026-08-04 Official page ↗
Status
Modified
Published
2023-09-20
Last modified
2026-08-04
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-148, CWE-863

Description

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Affected configurations

• quarkus quarkus (< 2.16.11) • quarkus quarkus (>= 3.2.0 < 3.2.6) • quarkus quarkus (>= 3.3.0 < 3.3.3) • redhat build of optaplanner 8.0 • redhat build of quarkus (>= 2.13.0 < 2.13.8) • redhat decision manager 7.0 • redhat integration camel k (< 1.10.2) • redhat integration camel quarkus • redhat integration service registry • redhat jboss middleware 1 • redhat jboss middleware text-only advisories 1.0 • redhat openshift serverless • redhat openshift serverless 1.0 • redhat process automation manager 7.0 • redhat openshift container platform 4.10 • redhat openshift container platform 4.11 • redhat openshift container platform 4.12

Related

Weakness · CWE (2)

  • CWE-148 Improper Neutralization of Input Leaders weakness
  • CWE-863 Incorrect Authorization weakness

References