7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
30.6%
A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.
CPE | Name | Operator | Version |
---|---|---|---|
io.quarkus:quarkus-oidc | lt | 3.1.0.Final | |
io.quarkus:quarkus-oidc | lt | 2.13.0.Final |
access.redhat.com/errata/RHSA-2023:3809
access.redhat.com/errata/RHSA-2023:7653
access.redhat.com/security/cve/CVE-2023-1584
bugzilla.redhat.com/show_bug.cgi?id=2180886
github.com/advisories/GHSA-6hc9-cf8x-hf83
github.com/quarkusio/quarkus/commit/5369d7ff233d3afe84ecd9160c541fba52b38e69
github.com/quarkusio/quarkus/commit/df305ff12386cf28b33567b8d9a18db164f019dd
github.com/quarkusio/quarkus/pull/32192
github.com/quarkusio/quarkus/pull/32192/commits/5369d7ff233d3afe84ecd9160c541fba52b38e69
github.com/quarkusio/quarkus/pull/33414
github.com/quarkusio/quarkus/pull/33414/commits/df305ff12386cf28b33567b8d9a18db164f019dd
nvd.nist.gov/vuln/detail/CVE-2023-1584