CVE-2023-5675

{"id": "CVE-2023-5675", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2024-04-25T16:15:08.570", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:0494", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:0495", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2023-5675", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245197", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:0494", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2024:0495", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/security/cve/CVE-2023-5675", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245197", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties."}, {"lang": "es", "value": "Se encontr\u00f3 un defecto en Quarkus. Cuando un endpoint Quarkus RestEasy Classic o Reactive JAX-RS tiene sus m\u00e9todos declarados en la clase Java abstracta o personalizados mediante extensiones de Quarkus utilizando el procesador de anotaciones, la autorizaci\u00f3n de estos m\u00e9todos no se aplicar\u00e1 si est\u00e1 habilitada por 'quarkus.security.jaxrs.deny-unannotated-endpoints' o 'quarkus.security.jaxrs.default-roles-allowed'."}], "lastModified": "2024-11-21T08:42:14.990", "sourceIdentifier": "secalert@redhat.com"}