Log in Start free

Vulnerability · Published Apr 25, 2024 · Assigned by redhat

CVE-2023-5675Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.

Medium 6.5

In plain English

A medium-severity security flaw in quarkus-resteasy-reactive. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 60.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenio.quarkus:quarkus-resteasy-reactive-common3.2.10.FinalGHSA-25w4-hfqg-4r52
Mavenio.quarkus:quarkus-resteasy-reactive-common3.6.9GHSA-25w4-hfqg-4r52
Mavenio.quarkus:quarkus-resteasy-reactive-common3.7.1GHSA-25w4-hfqg-4r52
Mavenio.quarkus:quarkus-resteasy-reactive-common-deployment3.2.10.FinalGHSA-25w4-hfqg-4r52
Mavenio.quarkus:quarkus-resteasy-reactive-common-deployment3.6.9GHSA-25w4-hfqg-4r52
Mavenio.quarkus:quarkus-resteasy-reactive-common-deployment3.7.1GHSA-25w4-hfqg-4r52

Affected products (as reported)

VendorProductVersions
quarkus-resteasy-reactive 3.2.0 – before 3.2.10.Final3.6.0 – before 3.6.93.7.0 – before 3.7.1
Red Hat Red Hat build of Quarkus 2.13.9.Final see references
Red Hat Red Hat build of Quarkus 2.13.9.Final see references
Red Hat Red Hat build of Quarkus 3.2.9.Final see references
Red Hat Red Hat build of Quarkus 3.2.9.Final see references
Red Hat A-MQ Clients 2 see references
Red Hat Cryostat 2 see references
Red Hat OpenShift Serverless see references
Red Hat Red Hat build of Apicurio Registry 2 see references
Red Hat Red Hat build of OptaPlanner 8 see references
Red Hat Red Hat Fuse 7 see references
Red Hat Red Hat Integration Camel K 1 see references
Red Hat Red Hat Integration Camel Quarkus 2 see references
Red Hat Red Hat JBoss Enterprise Application Platform 8 see references
Red Hat Red Hat Process Automation 7 see references

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References