CVE-2023-4853

Quarkus: http security policy bypass

CVSS 8.1 HIGHEPSS 1.2%CWE-148

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.1EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

20 set 2023Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

Red Hat · Openshift Serverless 1 on RHEL 8 Red Hat · Red Hat build of OptaPlanner 8 Red Hat · Red Hat build of Quarkus 2.13.8.SP2 Red Hat · Red Hat Camel Extensions for Quarkus 2.13.3-1 Red Hat · Red Hat OpenShift Serverless 1.30 Red Hat · Red Hat Process Automation 7 Red Hat · RHEL-8 based Middleware Containers Red Hat · RHINT Camel-K-1.10.2 Red Hat · RHINT Service Registry 2.5.4 GA Red Hat · RHPAM 7.13.4 async

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências