CVE-2023-1584

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-1584
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1584.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-1584
Aliases
Published
2023-10-04T10:47:37.831Z
Modified
2026-07-15T01:49:09.187498020Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Quarkus-oidc: id and access tokens leak via the authorization code flow
Details

A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1584.json",
    "cwe_ids": [
        "CWE-200"
    ],
    "cna_assigner": "redhat"
}
References

Affected packages

Git / github.com/quarkusio/quarkus

Affected ranges

Type
GIT
Repo
https://github.com/quarkusio/quarkus
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e77605f599e0f71f05e27dfd81308628ae7ffba3
Database specific 
{
    "cpe": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.13.8"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1584.json"