CVE-2023-4853 Quarkus: http security policy bypass
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
Problem types: cwe_id: CWE-148
description: Improper Neutralization of Input Leaders
Affected products: vendor: Red Hat
product: Openshift Serverless 1 on RHEL 8
cpes: cpe:/a:redhat:serverless:1.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat build of OptaPlanner 8
cpes: cpe:/a:redhat:optaplanner:::el6
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Quarkus 2.13.8.SP2
cpes: cpe:/a:redhat:quarkus:2.13
default_status: affected
vendor: Red Hat
product: Red Hat build of Quarkus 2.13.8.SP2
cpes: cpe:/a:redhat:quarkus:2.13
default_status: affected
vendor: Red Hat
product: Red Hat build of Quarkus 2.13.8.SP2
cpes: cpe:/a:redhat:quarkus:2.13
default_status: affected
vendor: Red Hat
product: Red Hat Camel Extensions for Quarkus 2.13.3-1
cpes: cpe:/a:redhat:camel_quarkus:2.13
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift Serverless 1.30
cpes: cpe:/a:redhat:openshift_serverless:1.30::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Serverless 1.30
cpes: cpe:/a:redhat:openshift_serverless:1.30::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Serverless 1.30
cpes: cpe:/a:redhat:openshift_serverless:1.30::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Serverless 1.30
cpes: cpe:/a:redhat:openshift_serverless:1.30::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Serverless 1.30
cpes: cpe:/a:redhat:openshift_serverless:1.30::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Serverless 1.30
cpes: cpe:/a:redhat:openshift_serverless:1.30::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Serverless 1.30
cpes: cpe:/a:redhat:openshift_serverless:1.30::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Serverless 1.30
cpes: cpe:/a:redhat:openshift_serverless:1.30::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Serverless 1.30
cpes: cpe:/a:redhat:openshift_serverless:1.30::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Serverless 1.30
cpes: cpe:/a:redhat:openshift_serverless:1.30::el8
default_status: affected
vendor: Red Hat
product: RHEL-8 based Middleware Containers
cpes: cpe:/a:redhat:rhosemc:1.0::el8
default_status: affected
vendor: Red Hat
product: RHEL-8 based Middleware Containers
cpes: cpe:/a:redhat:rhosemc:1.0::el8
default_status: affected
vendor: Red Hat
product: RHEL-8 based Middleware Containers
cpes: cpe:/a:redhat:rhosemc:1.0::el8
default_status: affected
vendor: Red Hat
product: RHEL-8 based Middleware Containers
cpes: cpe:/a:redhat:rhosemc:1.0::el8
default_status: affected
vendor: Red Hat
product: RHEL-8 based Middleware Containers
cpes: cpe:/a:redhat:rhosemc:1.0::el8
default_status: affected
vendor: Red Hat
product: RHINT Camel-K-1.10.2
cpes: cpe:/a:redhat:camel_k:1
default_status: unaffected
vendor: Red Hat
product: RHINT Service Registry 2.5.4 GA
cpes: cpe:/a:redhat:service_registry:2.5
default_status: unaffected
vendor: Red Hat
product: RHPAM 7.13.4 async
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13
default_status: unaffected
vendor: Red Hat
product: Red Hat Process Automation 7
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-09-20T09:47:32.150Z