CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-6267 – Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.
https://notcve.org/view.php?id=CVE-2023-6267
A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security. Se encontró un fallo en el payload json. Si se utiliza seguridad basada en anotaciones para proteger un recurso REST, el cuerpo JSON que el recurso puede consumir se procesa (deserializa) antes de que se evalúen y apliquen las restricciones de seguridad. • https://access.redhat.com/errata/RHSA-2024:0494 https://access.redhat.com/errata/RHSA-2024:0495 https://access.redhat.com/security/cve/CVE-2023-6267 https://bugzilla.redhat.com/show_bug.cgi?id=2251155 • CWE-280: Improper Handling of Insufficient Permissions or Privileges CWE-502: Deserialization of Untrusted Data CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-6394 – Quarkus: graphql operations over websockets bypass
https://notcve.org/view.php?id=CVE-2023-6394
A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions. Se encontró un defecto en Quarkus. Este problema ocurre cuando se recibe una solicitud a través de websocket sin ningún permiso basado en roles especificado en la operación GraphQL, Quarkus procesa la solicitud sin autenticación a pesar de que el endpoint está protegido. • https://access.redhat.com/errata/RHSA-2023:7612 https://access.redhat.com/security/cve/CVE-2023-6394 https://bugzilla.redhat.com/show_bug.cgi?id=2252197 https://access.redhat.com/errata/RHSA-2023:7700 • CWE-862: Missing Authorization •
CVSS: 8.1EPSS: 0%CPEs: 18EXPL: 1CVE-2023-4853 – Quarkus: http security policy bypass
https://notcve.org/view.php?id=CVE-2023-4853
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service. Se encontró una falla en Quarkus donde las políticas de seguridad HTTP no sanitiza correctamente ciertas permutaciones de caracteres al aceptar solicitudes, lo que resulta en una evaluación incorrecta de los permisos. Este problema podría permitir que un atacante eluda la política de seguridad por completo, lo que resultaría en un acceso no autorizado al endpoint y posiblemente una Denegación de Servicio. • https://access.redhat.com/errata/RHSA-2023:5170 https://access.redhat.com/errata/RHSA-2023:5310 https://access.redhat.com/errata/RHSA-2023:5337 https://access.redhat.com/errata/RHSA-2023:5446 https://access.redhat.com/errata/RHSA-2023:5479 https://access.redhat.com/errata/RHSA-2023:5480 https://access.redhat.com/errata/RHSA-2023:6107 https://access.redhat.com/errata/RHSA-2023:6112 https://access.redhat.com/errata/RHSA-2023:7653 https://access.redhat.com/security/cve&# • CWE-148: Improper Neutralization of Input Leaders CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0481 – quarkus: insecure permissions on temp files
https://notcve.org/view.php?id=CVE-2023-0481
In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user. • https://github.com/quarkusio/quarkus/pull/30694 https://access.redhat.com/security/cve/CVE-2023-0481 https://bugzilla.redhat.com/show_bug.cgi?id=2163533 • CWE-378: Creation of Temporary File With Insecure Permissions CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-4147 – quarkus-vertx-http: Security misconfiguration of CORS : OWASP A05_2021 level in Quarkus
https://notcve.org/view.php?id=CVE-2022-4147
Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request. El filtro Quarkus CORS permite que continúen solicitudes GET y POST simples con origen no válido. Las solicitudes GET o POST simples realizadas con XMLHttpRequest son aquellas que no tienen detectores de eventos registrados en el objeto devuelto por la propiedad de carga XMLHttpRequest y no tienen ningún objeto ReadableStream utilizado en la solicitud. A vulnerability was found in Quarkus. • https://access.redhat.com/security/cve/CVE-2022-4147 https://bugzilla.redhat.com/show_bug.cgi?id=2148867 • CWE CATEGORY •