VulnerabilityModified
CVE-2023-6394
This can allow an attacker to access information and functionality outside of normal granted API permissions.
CRITICAL 9.1EPSS 0.81%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.81%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.
- CVSS 3.1
- 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 0.81% probability · 55th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Affected
- quarkus/quarkus · redhat/build of quarkus
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2023:7612
- https://access.redhat.com/errata/RHSA-2023:7700
- https://access.redhat.com/security/cve/CVE-2023-6394Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2252197Issue Tracking
- https://access.redhat.com/errata/RHSA-2023:7612
- https://access.redhat.com/security/cve/CVE-2023-6394Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2252197Issue Tracking
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.