VulnerabilityModified
CVE-2023-5720
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain.
HIGH 7.5EPSS 0.81%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.81%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.81% probability · 55th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-526
- Affected
- quarkus/quarkus
- Source
- secalert@redhat.com
References
- https://access.redhat.com/security/cve/CVE-2023-5720Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2245700Issue Tracking, Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-5720Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2245700Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.