// For flags

CVE-2022-4147

quarkus-vertx-http: Security misconfiguration of CORS : OWASP A05_2021 level in Quarkus

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.

El filtro Quarkus CORS permite que continúen solicitudes GET y POST simples con origen no válido. Las solicitudes GET o POST simples realizadas con XMLHttpRequest son aquellas que no tienen detectores de eventos registrados en el objeto devuelto por la propiedad de carga XMLHttpRequest y no tienen ningún objeto ReadableStream utilizado en la solicitud.

A vulnerability was found in Quarkus. The Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest have no event listeners registered on the object returned by the XMLHttpRequest upload property, and have no ReadableStream object used in the request.

This release of Red Hat build of Quarkus 2.13.5 includes security updates, bug fixes, and enhancements. For more information, see the release notes page listed in the References section. Issues addressed include denial of service and remote SQL injection vulnerabilities.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
High
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-11-28 CVE Reserved
  • 2022-12-06 CVE Published
  • 2024-08-03 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE CATEGORY
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Quarkus
Search vendor "Quarkus"
 Quarkus
Search vendor "Quarkus" for product "Quarkus"
 >= 2.0 < 2.13.5
Search vendor "Quarkus" for product "Quarkus" and version " >= 2.0 < 2.13.5"
-
Affected
Quarkus
Search vendor "Quarkus"
 Quarkus
Search vendor "Quarkus" for product "Quarkus"
 >= 2.14.0 < 2.14.2
Search vendor "Quarkus" for product "Quarkus" and version " >= 2.14.0 < 2.14.2"
-
Affected