Lucene search
GoogleOSV:GHSA-MVC8-6FFP-JRX5HistoryDec 09, 2023 - 3:30 a.m.
Authorization bypass in Quarkus
2023-12-0903:30:15
Google
osv.dev
7
quarkus
authorization bypass
role-based permission
websocket
graphql
endpoint security
information disclosure
A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.
References
access.redhat.com/errata/RHSA-2023:7612
access.redhat.com/security/cve/CVE-2023-6394
bugzilla.redhat.com/show_bug.cgi?id=2252197
github.com/quarkusio/quarkus
github.com/quarkusio/quarkus/pull/36961
github.com/quarkusio/quarkus/releases/tag/2.13.9.Final
github.com/quarkusio/quarkus/releases/tag/3.5.3
nvd.nist.gov/vuln/detail/CVE-2023-6394
Related
cvelist
cvelist
CVE-2023-6394 Quarkus: graphql operations over websockets bypass
2023-12-09 01:26:52
cve
cve
CVE-2023-6394
2023-12-09 01:26:52
osv
osv
CVE-2023-6394
2023-12-09 02:15:06
redhatcve
redhatcve
CVE-2023-6394
2023-12-09 01:26:32
veracode
veracode
Authorization Bypass
2023-12-12 11:53:27
prion
prion
Authentication flaw
2023-12-09 02:15:00
github
github
Authorization bypass in Quarkus
2023-12-09 03:30:15
redhat
redhat