CVE-2023-4853

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-4853
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-4853.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-4853
Aliases
Downstream
Published
2023-09-20T09:47:32Z
Modified
2026-08-12T03:51:26Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Quarkus: http security policy bypass
Details

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Database specific 
{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-148"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4853.json"
}
References

Affected packages

Git / github.com/quarkusio/quarkus

Affected ranges

Type
GIT
Repo
https://github.com/quarkusio/quarkus
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1944de146a5e62dcf6d2cf631dd732bd5fbed069
Introduced
f9711bd42f79221a5bf9507e1ff0bd9db61601a3
Fixed
8b233d5b3f101f1e6ef4bc8a4307ca6f78a1ce8e
Introduced
2c6f8b84a115fbab00e562591a277dbeb8869c8d
Fixed
2ecbdf55b9b0b96577607e0226f4f487f3162ef2
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.16.11"
        },
        {
            "introduced": "3.2.0"
        },
        {
            "fixed": "3.2.6"
        },
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "3.3.3"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-4853.json"