Medium severity · published Apr 25, 2024
CVE-2023-5675
Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
A-MQ Clients 2 · Red Hat
All versions, or not specified · source: vendor
C2
Cryostat 2 · Red Hat
All versions, or not specified · source: vendor
OS
OpenShift Serverless · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Fuse 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Integration Camel K 1 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Integration Camel Quarkus 2 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Process Automation 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Apicurio Registry 2 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of OptaPlanner 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Quarkus 2.13.9.Final · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Quarkus 3.2.9.Final · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5675
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-5675
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:0494
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:0495
access.redhat.com
https://access.redhat.com/security/cve/CVE-2023-5675
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2245197
More from A-MQ Clients 2
4.3
CVE-2022-4245
Codehaus-plexus: xml external entity (xxe) injection