CVE-2023-4853
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
- Score
- CVSS 3.1 8.1 High
- Status
- Modified - secalert@redhat.com
- Published
- 2023-09-20
- Last modified
- 2026-08-04
- Weaknesses
- CWE-148, CWE-863
Affected products
- Quarkus (Quarkus)
- Build Of Optaplanner (Redhat)
- Build Of Quarkus (Redhat)
- Camel K (Redhat)
- Camel Quarkus (Redhat)
- Decision Manager (Redhat)
- Integration Camel K (Redhat)
- Integration Camel Quarkus (Redhat)
- Integration Service Registry (Redhat)
- Jboss Enterprise Bpms Platform (Redhat)
- Jboss Middleware (Redhat)
- Jboss Middleware Text-only Advisories (Redhat)
- Openshift Container Platform (Redhat)
- Openshift Serverless (Redhat)
- Optaplanner (Redhat)
- Process Automation Manager (Redhat)
- Quarkus (Redhat)
- Rhosemc (Redhat)
- Serverless (Redhat)
- Service Registry (Redhat)
References
- https://access.redhat.com/errata/RHSA-2023:5170
- https://access.redhat.com/errata/RHSA-2023:5310
- https://access.redhat.com/errata/RHSA-2023:5337
- https://access.redhat.com/errata/RHSA-2023:5446
- https://access.redhat.com/errata/RHSA-2023:5479
- https://access.redhat.com/errata/RHSA-2023:5480
- https://access.redhat.com/errata/RHSA-2023:6107
- https://access.redhat.com/errata/RHSA-2023:6112
- https://access.redhat.com/errata/RHSA-2023:7653
- https://access.redhat.com/security/cve/CVE-2023-4853
- https://access.redhat.com/security/vulnerabilities/RHSB-2023-002
- https://bugzilla.redhat.com/show_bug.cgi?id=2238034
