CVE-2023-1584

A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2023:3809	Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7653
https://access.redhat.com/security/cve/CVE-2023-1584	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2180886	Issue Tracking Third Party Advisory
https://github.com/quarkusio/quarkus/pull/32192	Vendor Advisory
https://github.com/quarkusio/quarkus/pull/33414	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*

History

03 May 2024, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-04 11:15

Updated : 2024-05-03 16:15

NVD link : CVE-2023-1584

Mitre link : CVE-2023-1584

CVE.ORG link : CVE-2023-1584

JSON object : View

Products Affected

quarkus

quarkus

CWE

NVD-CWE-noinfo CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2023-1584", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-10-04T11:15:09.770", "references": [{"url": "https://access.redhat.com/errata/RHSA-2023:3809", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2023:7653", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2023-1584", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2180886", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/quarkusio/quarkus/pull/32192", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/quarkusio/quarkus/pull/33414", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens."}, {"lang": "es", "value": "Se encontr\u00f3 un defecto en Quarkus. Quarkus OIDC puede filtrar tanto ID como tokens de acceso en el flujo del c\u00f3digo de autorizaci\u00f3n cuando se utiliza un protocolo HTTP inseguro, lo que puede permitir a los atacantes acceder a datos confidenciales del usuario directamente desde el token de ID o utilizando el token de acceso para acceder a los datos del usuario desde los servicios del proveedor OIDC. . Tenga en cuenta que las contrase\u00f1as no se almacenan en tokens de acceso."}], "lastModified": "2024-05-03T16:15:10.503", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77E10BE3-2878-4766-81B6-F20A28986885", "versionEndExcluding": "2.13.8"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}