CVE-2023-6267

HIGH

Quarkus < 2.13.9 - Unauthenticated JSON Payload Deserialization

Title source: llm
STIX 2.1

Description

A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.

References (4)

Core 4
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:0494
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:0495
Vendor Advisory vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2023-6267
Issue Tracking, Vendor Advisory issue-tracking x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2251155

Scores

CVSS v3 8.6
EPSS 0.0072
EPSS Percentile 48.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-755
Status published
Products (4)
io.quarkus.resteasy.reactive/resteasy-reactive 0 - 2.13.9.FinalMaven
quarkus/quarkus 2.13.9
quarkus/quarkus 3.2.9
quarkus/quarkus < 2.13.9
Published Jan 25, 2024
Tracked Since Feb 18, 2026