CVE-2024-12397

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-12397
A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

7.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2025:0900
https://access.redhat.com/errata/RHSA-2025:3018
https://access.redhat.com/errata/RHSA-2025:8761
https://access.redhat.com/security/cve/CVE-2024-12397
https://bugzilla.redhat.com/show_bug.cgi?id=2331298
Configurations

No configuration.

History

10 Jun 2025, 11:15

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2025:1082', 'source': 'secalert@redhat.com'}
  • () https://access.redhat.com/errata/RHSA-2025:8761 -

19 Mar 2025, 21:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:3018 -

07 Feb 2025, 05:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:0900 -
  • () https://access.redhat.com/errata/RHSA-2025:1082 -

12 Dec 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-12 09:15

Updated : 2025-06-10 11:15

NVD link : CVE-2024-12397

Mitre link : CVE-2024-12397

CVE.ORG link : CVE-2024-12397

JSON object : View

Products Affected

No product.

CWE
CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')