CVE-2023-4853 Vulnerability Details

  /     /     /  

CVE-2023-4853 Metadata Quick Info

CVE Published: 20/09/2023 | CVE Updated: 23/11/2024 | CVE Year: 2023
Source: redhat | Vendor: Red Hat | Product: Openshift Serverless 1 on RHEL 8
Status : PUBLISHED

---

CVE-2023-4853 Description

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-148
CWE Name: Improper Neutralization of Input Leaders
Source: Red Hat

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).