quarkus: HTTP security policy bypass

🗓️ 05 Dec 2023 14:36:34Reported by RedHatType

Quarkus flaw allows bypass of web security policy via improper sanitization of character permutations, risking unauthorized access.

Reporter	Title	Published	Views	Family All 46
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 8.0.4-IF001	29 Nov 202320:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Processing is vulnerable to a denial of service	31 Oct 202302:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 8.0.4	11 Oct 202314:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Automation Decision Services November 2023 - Multiple CVEs addressed	12 Dec 202317:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Endpoint Management is vulnerable to a denial of service	31 Oct 202302:34	–	ibm
BDU FSTEC	The vulnerability of Quarkus’ HTTP security policy allows attackers to circumvent security restrictions, gain unauthorized access to protected information, or cause service failures.	12 Sep 202300:00	–	bdu_fstec
Circl	CVE-2023-4853	20 Sep 202314:30	–	circl
CNNVD	Quarkus Security Vulnerabilities	8 Sep 202300:00	–	cnnvd
CVE	CVE-2023-4853	20 Sep 202309:47	–	cve
Cvelist	CVE-2023-4853 Quarkus: http security policy bypass	20 Sep 202309:47	–	cvelist

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2023-4853
access	www.access.redhat.com/security/vulnerabilities/RHSB-2023-002
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-4853
cve	www.cve.org/CVERecord

01 Jul 2026 13:52Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.18.1

EPSS0.01215