CVE-2023-4853

moderate-risk

Published 2023-09-20

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Do I need to act?

0.46% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.1/10 High

NETWORK / HIGH complexity

Affected Products (15)

Quarkus

Build Of Optaplanner

Build Of Quarkus

Decision Manager

Integration Camel K

Integration Camel Quarkus

Integration Service Registry

Jboss Middleware

Jboss Middleware Text-Only Advisories

Openshift Serverless

Process Automation Manager

Openshift Container Platform

Affected Vendors

Redhat Quarkus

References (24)

Vendor Advisory https://access.redhat.com/errata/RHSA-2023:5170

Vendor Advisory https://access.redhat.com/errata/RHSA-2023:5310

Vendor Advisory https://access.redhat.com/errata/RHSA-2023:5337

Vendor Advisory https://access.redhat.com/errata/RHSA-2023:5446

Vendor Advisory https://access.redhat.com/errata/RHSA-2023:5479

Vendor Advisory https://access.redhat.com/errata/RHSA-2023:5480

Vendor Advisory https://access.redhat.com/errata/RHSA-2023:6107

Vendor Advisory https://access.redhat.com/errata/RHSA-2023:6112

Vendor Advisory https://access.redhat.com/errata/RHSA-2023:7653

Mitigation https://access.redhat.com/security/cve/CVE-2023-4853

Exploit https://access.redhat.com/security/vulnerabilities/RHSB-2023-002

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2238034