Quarkus 安全漏洞

Quarkus is a cloud-native Linux container-first framework for writing Java applications from the Quarkus open source. A security vulnerability exists in Quarkus that stems from an undisabled default REST endpoint in the quarkus-security-webauthn module, which could lead to arbitrary user login...

io.quarkus:quarkus-security-webauthn-deployment (>=3.0.0.Alpha1 <=3.18.0), io.quarkus:quarkus-test-security-webauthn (>=3.0.0.Alpha1 <=3.18.0) potentially affected by CVE-2024-12225 via io.quarkus:quarkus-security-webauthn (>=3.0.0.Alpha1 <=3.18.0)

io.quarkus:quarkus-security-webauthn MAVEN version =3.0.0.Alpha1, =3.0.0.Alpha1, =3.0.0.Alpha1, =3.18.0 Source cves: CVE-2024-12225 Source advisory: SNYK:JAVA-IOQUARKUS-9376953...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel through the default REST endpoints. An attacker can bypass authentication controls and potentially log in as an existing user without proper credentials by exploiting these...