Improper access control in Quarkus - CVE-2023-6393
Published: December 7, 2023
Vulnerability identifier: #VU83981
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-6393
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the
cached Uni reuses the initial "completion" context, the processing
switches to the cached Uni instead of the request context. A remote user can send a specially crafted request to the server and obtain information that belongs to another user.
Affected software
Quarkus
Red Hat build of Quarkus
Red Hat build of Quarkus
How to mitigate CVE-2023-6393
Install updates from vendor's website.
Quarkus - update to 2.13.9
Red Hat build of Quarkus - update to 2.13.9
Red Hat build of Quarkus - update to 2.13.9