Vulnerability · Published Nov 15, 2023 · Assigned by redhat
CVE-2023-5720Quarkus: build env information disclosure via gradle plugin
High 7.7
In plain English
A high-severity security flaw in gradle-plugin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.8%top 42.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | io.quarkus:quarkus-project | no fix listed | GHSA-p62q-5483-h57v |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | gradle-plugin | see references |
Weakness: CWE-526 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
- https://access.redhat.com/security/cve/CVE-2023-5720 vdb-entry, x_refsource_REDHAT
- RHBZ#2245700 issue-tracking, x_refsource_REDHAT