Input validation error in Quarkus - CVE-2024-12397
Published: February 11, 2025
Vulnerability identifier: #VU103760
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-12397
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of cookies with certain value-delimiting characters in incoming requests in Quarkus-HTTP. A remote attacker can construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification.
Affected software
Quarkus
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Red Hat Integration Camel Extensions for Quarkus
Red Hat Camel for Spring Boot
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Red Hat Integration Camel Extensions for Quarkus
Red Hat Camel for Spring Boot
How to mitigate CVE-2024-12397
Install updates from vendor's website.
Quarkus - update to 3.15.3
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.1.3
Red Hat Integration Camel Extensions for Quarkus - update to 3.15.3
Red Hat Camel for Spring Boot - update to 4.8
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.1.3
Red Hat Integration Camel Extensions for Quarkus - update to 3.15.3
Red Hat Camel for Spring Boot - update to 4.8