CVE-2023-1584

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-1584
A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2023:3809 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7653
https://access.redhat.com/security/cve/CVE-2023-1584 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2180886 Issue Tracking Third Party Advisory
https://github.com/quarkusio/quarkus/pull/32192 Vendor Advisory
https://github.com/quarkusio/quarkus/pull/33414 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3809 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7653
https://access.redhat.com/security/cve/CVE-2023-1584 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2180886 Issue Tracking Third Party Advisory
https://github.com/quarkusio/quarkus/pull/32192 Vendor Advisory
https://github.com/quarkusio/quarkus/pull/33414 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:39

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2023:3809 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2023:3809 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7653 - () https://access.redhat.com/errata/RHSA-2023:7653 -
References () https://access.redhat.com/security/cve/CVE-2023-1584 - Third Party Advisory () https://access.redhat.com/security/cve/CVE-2023-1584 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2180886 - Issue Tracking, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=2180886 - Issue Tracking, Third Party Advisory
References () https://github.com/quarkusio/quarkus/pull/32192 - Vendor Advisory () https://github.com/quarkusio/quarkus/pull/32192 - Vendor Advisory
References () https://github.com/quarkusio/quarkus/pull/33414 - Vendor Advisory () https://github.com/quarkusio/quarkus/pull/33414 - Vendor Advisory

03 May 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-10-04 11:15

Updated : 2024-11-21 07:39

NVD link : CVE-2023-1584

Mitre link : CVE-2023-1584

CVE.ORG link : CVE-2023-1584

JSON object : View

Products Affected

quarkus

  • quarkus
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo