CVE-2023-5675
Assigner: redhat
Published: 2024-04-25T15:44:55.582Z
State: PUBLISHED
title: Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
metrics: other: content: value: Moderate
namespace: https://access.redhat.com/security/updates/classification/
type: Red Hat severity rating
cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
format: CVSS
descriptions: value: A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
affected: vendor: Red Hat
product: Red Hat build of Quarkus 2.13.9.Final
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: io.quarkus/quarkus-resteasy
defaultStatus: affected
versions: version: 2.13.9.Final-redhat-00003
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:quarkus:2.13
vendor: Red Hat
product: Red Hat build of Quarkus 2.13.9.Final
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: io.quarkus/quarkus-resteasy-reactive
defaultStatus: affected
versions: version: 2.13.9.Final-redhat-00003
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:quarkus:2.13
vendor: Red Hat
product: Red Hat build of Quarkus 3.2.9.Final
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: io.quarkus/quarkus-resteasy
defaultStatus: affected
versions: version: 3.2.9.Final-redhat-00003
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:quarkus:3.2
vendor: Red Hat
product: Red Hat build of Quarkus 3.2.9.Final
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: io.quarkus/quarkus-resteasy-reactive
defaultStatus: affected
versions: version: 3.2.9.Final-redhat-00003
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:quarkus:3.2
vendor: Red Hat
product: A-MQ Clients 2
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: quarkus-resteasy-reactive
defaultStatus: unknown
cpes: cpe:/a:redhat:a_mq_clients:2
vendor: Red Hat
product: Cryostat 2
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: quarkus-resteasy-reactive
defaultStatus: unknown
cpes: cpe:/a:redhat:cryostat:2
vendor: Red Hat
product: OpenShift Serverless
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: quarkus-resteasy-reactive
defaultStatus: unknown
cpes: cpe:/a:redhat:serverless:1
vendor: Red Hat
product: Red Hat build of OptaPlanner 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: quarkus-resteasy-reactive
defaultStatus: unknown
cpes: cpe:/a:redhat:optaplanner:::el6
vendor: Red Hat
product: Red Hat Integration Camel K
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: quarkus-resteasy-reactive
defaultStatus: unknown
cpes: cpe:/a:redhat:integration:1
vendor: Red Hat
product: Red Hat Integration Camel Quarkus
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: quarkus-resteasy-reactive
defaultStatus: unknown
cpes: cpe:/a:redhat:camel_quarkus:2
vendor: Red Hat
product: Red Hat Integration Service Registry
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: quarkus-resteasy-reactive
defaultStatus: unknown
cpes: cpe:/a:redhat:service_registry:2
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: quarkus-resteasy-reactive
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8
vendor: Red Hat
product: Red Hat JBoss Fuse 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: quarkus-resteasy-reactive
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_fuse:7
vendor: Red Hat
product: Red Hat Process Automation 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: quarkus-resteasy-reactive
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
datePublic: 2024-01-24T00:00:00+00:00
problemTypes: descriptions: cweId: CWE-285
description: Improper Authorization
type: CWE
x_redhatCweChain: CWE-285: Improper Authorization
timeline: time: 2023-10-16T00:00:00+00:00
value: Reported to Red Hat.
time: 2024-01-24T00:00:00+00:00
value: Made public.
credits: value: Red Hat would like to thank Michal Vavřík (Redhat) for reporting this issue.