Lucene search

K
githubGitHub Advisory DatabaseGHSA-8J3X-W35R-RW4R
HistoryJan 25, 2024 - 9:32 p.m.

Quarkus Improper Handling of Insufficient Permissions or Privileges and Improper Handling of Exceptional Conditions vulnerability

2024-01-2521:32:14
CWE-280
CWE-755
GitHub Advisory Database
github.com
10
quarkus
json payload
security
vulnerability
deserialization
configuration-based
annotation-based
rest resource

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.7 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

29.8%

A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.

Affected configurations

Vulners
Node
io.quarkus.resteasy.reactive\resteasyMatchreactive
OR
io.quarkus.resteasy.reactive\resteasyMatchreactive

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.7 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

29.8%