CVE-2023-5675 Vulnerability Details

  /     /     /  

CVE-2023-5675 Metadata Quick Info

CVE Published: 25/04/2024 | CVE Updated: 24/11/2024 | CVE Year: 2023
Source: redhat | Vendor: | Product:
Status : PUBLISHED

---

CVE-2023-5675 Description

A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either \'quarkus.security.jaxrs.deny-unannotated-endpoints\' or \'quarkus.security.jaxrs.default-roles-allowed\' properties.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-285
CWE Name: Improper Authorization
Source:

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).