Yüksek CVSS 8.1 PoC var

CVE-2023-4853: Quarkus: güvenlik açığı

Yayın: 20 Eylül 2023 13:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Özet bilgiler

Ürün: Quarkus Quarkus
CVSS v3.1: 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: %2,28 (yüzdelik 83)
CWE: CWE-148
Yama: Geçici çözüm

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
quarkus-quarkus	—	—	2.16.11
quarkus-quarkus	3.2.0	—	3.2.6
quarkus-quarkus	3.3.0	—	3.3.3
redhat-build-of-optaplanner	8.0	8.0	—
redhat-build-of-quarkus	2.13.0	—	2.13.8
redhat-decision-manager	7.0	7.0	—
redhat-integration-camel-k	—	—	1.10.2
redhat-integration-camel-quarkus	—	—	—
redhat-integration-service-registry	—	—	—
redhat-jboss-middleware	1	1	—
redhat-jboss-middleware-text-only-advisories	1.0	1.0	—
redhat-openshift-serverless	—	—	—
redhat-openshift-serverless	1.0	1.0	—
redhat-process-automation-manager	7.0	7.0	—
redhat-openshift-container-platform	4.10	4.10	—
redhat-openshift-container-platform	4.11	4.11	—
redhat-openshift-container-platform	4.12	4.12	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları