CVE-2023-4853

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-4853
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2023:5170 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5310 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5337 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5446 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5479 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5480 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:6107 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:6112 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:7653 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-4853 Mitigation Vendor Advisory
https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 Exploit Mitigation Technical Description Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2238034 Issue Tracking Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5170 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5310 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5337 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5446 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5479 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5480 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:6107 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:6112 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:7653 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-4853 Mitigation Vendor Advisory
https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 Exploit Mitigation Technical Description Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2238034 Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:redhat:build_of_optaplanner:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:build_of_quarkus:*:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:integration_camel_k:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:integration_camel_quarkus:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_middleware:1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*
cpe:2.3:a:redhat:openshift_serverless:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_serverless:1.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:process_automation_manager:7.0:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
History

21 Nov 2024, 08:36

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2023:5170 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:5170 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:5310 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:5310 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:5337 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:5337 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:5446 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:5446 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:5479 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:5479 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:5480 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:5480 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:6107 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:6107 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:6112 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:6112 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:7653 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:7653 - Vendor Advisory
References () https://access.redhat.com/security/cve/CVE-2023-4853 - Mitigation, Vendor Advisory () https://access.redhat.com/security/cve/CVE-2023-4853 - Mitigation, Vendor Advisory
References () https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 - Exploit, Mitigation, Technical Description, Vendor Advisory () https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 - Exploit, Mitigation, Technical Description, Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2238034 - Issue Tracking, Vendor Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=2238034 - Issue Tracking, Vendor Advisory

21 Dec 2023, 01:02

Type Values Removed Values Added
CPE cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
References (MISC) https://access.redhat.com/errata/RHSA-2023:6112 - (MISC) https://access.redhat.com/errata/RHSA-2023:6112 - Vendor Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:6107 - (MISC) https://access.redhat.com/errata/RHSA-2023:6107 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:7653 - () https://access.redhat.com/errata/RHSA-2023:7653 - Vendor Advisory

05 Dec 2023, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-09-20 10:15

Updated : 2024-11-21 08:36

NVD link : CVE-2023-4853

Mitre link : CVE-2023-4853

CVE.ORG link : CVE-2023-4853

JSON object : View

Products Affected

quarkus

  • quarkus

redhat

  • enterprise_linux
  • openshift_serverless
  • integration_camel_quarkus
  • process_automation_manager
  • build_of_quarkus
  • integration_camel_k
  • openshift_container_platform
  • jboss_middleware_text-only_advisories
  • decision_manager
  • build_of_optaplanner
  • jboss_middleware
  • integration_service_registry
CWE
CWE-148

Improper Neutralization of Input Leaders

CWE-863

Incorrect Authorization