CVE-2023-6267

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-6267
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6267.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-6267
Aliases
Published
2024-01-25T18:12:44.771Z
Modified
2026-08-12T03:51:12.078771881Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H CVSS Calculator
Summary
Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.
Details

A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.

Database specific 
{
    "cwe_ids": [
        "CWE-755"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6267.json",
    "cna_assigner": "redhat"
}
References

Affected packages

Git / github.com/quarkusio/quarkus

Affected ranges

Type
GIT
Repo
https://github.com/quarkusio/quarkus
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1c4c66457ef0a09be0cd79ed1b69fedfa3556775
Introduced
fe1e760b453ce20b815efb4af7fdf6227535be16
Fixed
d6e52f7775ca99237074e55d87df355980d8b6b5
Introduced
1c4c66457ef0a09be0cd79ed1b69fedfa3556775
Last affected
d6e52f7775ca99237074e55d87df355980d8b6b5
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:quarkus:quarkus:2.13.9:-:*:*:*:*:*:*",
        "cpe:2.3:a:quarkus:quarkus:3.2.9:-:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.13.9"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.2.9"
        },
        {
            "introduced": "2.13.9-NA"
        },
        {
            "last_affected": "2.13.9-NA"
        },
        {
            "introduced": "3.2.9-NA"
        },
        {
            "last_affected": "3.2.9-NA"
        }
    ]
}

Affected versions

2.*
2.13.9-NA
3.*
3.2.9-NA
3.2.9.Final

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6267.json"