Lucene search
GitHub Advisory DatabaseGHSA-MVC8-6FFP-JRX5HistoryDec 09, 2023 - 3:30 a.m.
Authorization bypass in Quarkus
2023-12-0903:30:15
CWE-696
CWE-862
GitHub Advisory Database
github.com
14
quarkus
websocket
authentication
authorization
graphql
A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.
| CPE | Name | Operator | Version |
|---|---|---|---|
| io.quarkus:quarkus-smallrye-graphql-client | lt | 2.13.9.Final | |
| io.quarkus:quarkus-smallrye-graphql-client | lt | 3.5.3 |
References
access.redhat.com/errata/RHSA-2023:7612
access.redhat.com/security/cve/CVE-2023-6394
bugzilla.redhat.com/show_bug.cgi?id=2252197
github.com/advisories/GHSA-mvc8-6ffp-jrx5
github.com/quarkusio/quarkus/pull/36961
github.com/quarkusio/quarkus/releases/tag/2.13.9.Final
github.com/quarkusio/quarkus/releases/tag/3.5.3
nvd.nist.gov/vuln/detail/CVE-2023-6394
Related
cve
cve
CVE-2023-6394
2023-12-09 01:26:52
osv
osv
CVE-2023-6394
2023-12-09 02:15:06
Authorization bypass in Quarkus
2023-12-09 03:30:15
redhatcve
redhatcve
CVE-2023-6394
2023-12-09 01:26:32
veracode
veracode
Authorization Bypass
2023-12-12 11:53:27
cvelist
cvelist
CVE-2023-6394 Quarkus: graphql operations over websockets bypass
2023-12-09 01:26:52
prion
prion
Authentication flaw
2023-12-09 02:15:00
redhat
redhat