GitHub Advisoryadvisory · Maven

GHSA-p62q-5483-h57v Quarkus does not properly sanitize artifacts created from its use of the Gradle plugin, allowing certain build system information to remain

HIGH Published 2023-11-15 Modified 2023-11-15 Official page ↗
Aliases
CVE-2023-5720
Ecosystem
Maven
Packages
io.quarkus:quarkus-project
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-526
Reviewed
2023-11-15

Affected packages

• Maven io.quarkus:quarkus-project: >= 3.0.0.CR1, <= 3.5.1 (no fix yet)

Description

A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.

Related

Alias · CVE (1)

  • CVE-2023-5720 A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system… vulnerability

Weakness · CWE (1)

  • CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable weakness

References