CVE-2023-6394
Quarkus: graphql operations over websockets bypass
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 7.4EPSS 0.8%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Lifecycle
09 Dec 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Red Hat · Red Hat build of Quarkus 2.13.9.FinalRed Hat · Red Hat build of Quarkus 3.2.9.FinalWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →