GitHub Advisoryadvisory · Maven

GHSA-g56w-cwg4-hxx9 Code injection in quarkus dev ui config editor

CRITICAL Published 2022-11-22 Modified 2022-11-26 Official page ↗
Aliases
CVE-2022-4116
Ecosystem
Maven
Packages
io.quarkus:quarkus-vertx-http-deployment
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74, CWE-94
Reviewed
2022-11-23

Affected packages

• Maven io.quarkus:quarkus-vertx-http-deployment: >= 2.14.0, < 2.14.2.Final → fixed in 2.14.2.Final • Maven io.quarkus:quarkus-vertx-http-deployment: < 2.13.5.Final → fixed in 2.13.5.Final

Description

A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.

Related

Alias · CVE (1)

  • CVE-2022-4116 A vulnerability was found in quarkus. vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-94 Improper Control of Generation of Code weakness

References