CVE-2023-4853

HIGH EPSS 64.8%

Published Sep 20, 20232y ago · Modified Jun 17, 20261w ago

8.1 CVSS 3.1

High

Published Sep 20, 2023 2y ago

Last Modified Jun 17, 2026 1w ago

Description

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

CVSS Details

Base Score

8.1

Exploitability

2.2

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity High

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

64.8% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 2

CWE-148

CWE-863 Incorrect Authorization Authorization

Affected Products 18

Vendor	Product	Version	Range
quarkus	quarkus	*	<2.16.11
quarkus	quarkus	*	≥3.2.0 – <3.2.6
quarkus	quarkus	*	≥3.3.0 – <3.3.3
redhat	build_of_optaplanner	8.0	any
redhat	build_of_quarkus	*	≥2.13.0 – <2.13.8
redhat	decision_manager	7.0	any
redhat	integration_camel_k	*	<1.10.2
redhat	integration_camel_quarkus	*	any
redhat	integration_service_registry	*	any
redhat	jboss_middleware	1	any
redhat	jboss_middleware_text-only_advisories	1.0	any
redhat	openshift_serverless	*	any
redhat	openshift_serverless	1.0	any
redhat	process_automation_manager	7.0	any
redhat	openshift_container_platform	4.10	any
redhat	openshift_container_platform	4.11	any
redhat	openshift_container_platform	4.12	any
redhat	enterprise_linux	8.0	any

References 12

access.redhat.com https://access.redhat.com/errata/RHSA-2023:5170

Vendor Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2023:5310

Vendor Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2023:5337

Vendor Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2023:5446

Vendor Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2023:5479

Vendor Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2023:5480

Vendor Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2023:6107

Vendor Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2023:6112

Vendor Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2023:7653

Vendor Advisory
access.redhat.com https://access.redhat.com/security/cve/CVE-2023-4853

MitigationVendor Advisory
access.redhat.com https://access.redhat.com/security/vulnerabilities/RHSB-2023-002

ExploitMitigationTechnical DescriptionVendor Advisory
bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2238034

Issue TrackingVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.