Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tdmM4LTZmZnAtanJ4Nc4AA3pp

Authorization bypass in Quarkus

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.

Permalink: https://github.com/advisories/GHSA-mvc8-6ffp-jrx5
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tdmM4LTZmZnAtanJ4Nc4AA3pp
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: 6 months ago

CVSS Score: 7.4
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Percentage: 0.0015
EPSS Percentile: 0.51871

Identifiers: GHSA-mvc8-6ffp-jrx5, CVE-2023-6394
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-6394
• https://access.redhat.com/security/cve/CVE-2023-6394
• https://bugzilla.redhat.com/show_bug.cgi?id=2252197
• https://github.com/quarkusio/quarkus/pull/36961
• https://github.com/quarkusio/quarkus/releases/tag/2.13.9.Final
• https://github.com/quarkusio/quarkus/releases/tag/3.5.3
• https://access.redhat.com/errata/RHSA-2023:7612
• https://access.redhat.com/errata/RHSA-2023:7700
• https://github.com/advisories/GHSA-mvc8-6ffp-jrx5

Repository: https://github.com/quarkusio/quarkus
Blast Radius: 14.9

Affected Packages