Skip to main content

Improper Authorization

CVE-2023-5675

Medium
6.5/10

Summary

A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties. This vulnerability affects Quarkus package versions through 3.2.9.Final, 3.3.0.CR1 through 3.6.7, 3.7.0.CR1 and 3.7.0. NOTE: This shares same fix commit as CVE-2023-6267.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-285 - Improper Authorization

The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References

Advisory Timeline

  • Published