CVE-2023-5675 (GCVE-0-2023-5675)

Vulnerability from cvelistv5 – Published: 2024-04-25 15:44 – Updated: 2025-11-20 18:06
VLAI
Title
Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
Summary
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-25 19:40 UTC
CWE
Assigner
References
URL Tags
https://access.redhat.com/errata/RHSA-2024:0494 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:0495 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2023-5675 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2245197 issue-trackingx_refsource_REDHAT
Impacted products
Vendor Product Version CPE status
Affected: 3.2.0 , < 3.2.10.Final (maven)
Affected: 3.6.0 , < 3.6.9 (maven)
Affected: 3.7.0 , < 3.7.1 (maven)
Unaffected: 3.8.0 , < 3.8.* (maven)
Red Hat Red Hat build of Quarkus 2.13.9.Final Unaffected: 2.13.9.Final-redhat-00003 , < * (rpm)
    cpe:/a:redhat:quarkus:2.13
Create a notification for this product.
Red Hat Red Hat build of Quarkus 3.2.9.Final Unaffected: 3.2.9.Final-redhat-00003 , < * (rpm)
    cpe:/a:redhat:quarkus:3.2
Create a notification for this product.
Red Hat A-MQ Clients 2     cpe:/a:redhat:a_mq_clients:2
Create a notification for this product.
Red Hat Cryostat 2     cpe:/a:redhat:cryostat:2
Create a notification for this product.
Red Hat OpenShift Serverless     cpe:/a:redhat:serverless:1
Create a notification for this product.
Red Hat Red Hat build of Apicurio Registry 2     cpe:/a:redhat:service_registry:2
Create a notification for this product.
Red Hat Red Hat build of OptaPlanner 8     cpe:/a:redhat:optaplanner:::el6
Create a notification for this product.
Red Hat Red Hat Fuse 7     cpe:/a:redhat:jboss_fuse:7
Create a notification for this product.
Red Hat Red Hat Integration Camel K 1     cpe:/a:redhat:integration:1
Create a notification for this product.
Red Hat Red Hat Integration Camel Quarkus 2     cpe:/a:redhat:camel_quarkus:2
Create a notification for this product.
Red Hat Red Hat JBoss Enterprise Application Platform 8     cpe:/a:redhat:jboss_enterprise_application_platform:8
Create a notification for this product.
Red Hat Red Hat Process Automation 7     cpe:/a:redhat:jboss_enterprise_bpms_platform:7
Create a notification for this product.
Date Public
2024-01-24 00:00
Credits
This issue was discovered by Michal Vavřík (Red Hat).
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-5675",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-25T19:40:04.917288Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-18T18:37:54.897Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:07:32.514Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2024:0494",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0494"
          },
          {
            "name": "RHSA-2024:0495",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0495"
          },
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2023-5675"
          },
          {
            "name": "RHBZ#2245197",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245197"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://mvnrepository.com/artifact/io.quarkus",
          "defaultStatus": "unaffected",
          "packageName": "quarkus-resteasy-reactive",
          "versions": [
            {
              "lessThan": "3.2.10.Final",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "maven"
            },
            {
              "lessThan": "3.6.9",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "maven"
            },
            {
              "lessThan": "3.7.1",
              "status": "affected",
              "version": "3.7.0",
              "versionType": "maven"
            },
            {
              "lessThan": "3.8.*",
              "status": "unaffected",
              "version": "3.8.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:quarkus:2.13"
          ],
          "defaultStatus": "affected",
          "packageName": "io.quarkus/quarkus-resteasy",
          "product": "Red Hat build of Quarkus 2.13.9.Final",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.13.9.Final-redhat-00003",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:quarkus:2.13"
          ],
          "defaultStatus": "affected",
          "packageName": "io.quarkus/quarkus-resteasy-reactive",
          "product": "Red Hat build of Quarkus 2.13.9.Final",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.13.9.Final-redhat-00003",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:quarkus:3.2"
          ],
          "defaultStatus": "affected",
          "packageName": "io.quarkus/quarkus-resteasy",
          "product": "Red Hat build of Quarkus 3.2.9.Final",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3.2.9.Final-redhat-00003",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:quarkus:3.2"
          ],
          "defaultStatus": "affected",
          "packageName": "io.quarkus/quarkus-resteasy-reactive",
          "product": "Red Hat build of Quarkus 3.2.9.Final",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3.2.9.Final-redhat-00003",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:a_mq_clients:2"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "A-MQ Clients 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:cryostat:2"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "Cryostat 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:service_registry:2"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "Red Hat build of Apicurio Registry 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:optaplanner:::el6"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "Red Hat build of OptaPlanner 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_fuse:7"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "Red Hat Fuse 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:integration:1"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "Red Hat Integration Camel K 1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:camel_quarkus:2"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "Red Hat Integration Camel Quarkus 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "Red Hat Process Automation 7",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Michal Vav\u0159\u00edk (Red Hat)."
        }
      ],
      "datePublic": "2024-01-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either \u0027quarkus.security.jaxrs.deny-unannotated-endpoints\u0027 or \u0027quarkus.security.jaxrs.default-roles-allowed\u0027 properties."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-20T18:06:41.381Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:0494",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0494"
        },
        {
          "name": "RHSA-2024:0495",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0495"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2023-5675"
        },
        {
          "name": "RHBZ#2245197",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245197"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-10-16T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-01-24T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Quarkus: authorization flaw in quarkus resteasy reactive and classic when \"quarkus.security.jaxrs.deny-unannotated-endpoints\" or \"quarkus.security.jaxrs.default-roles-allowed\" properties are used.",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_redhatCweChain": "CWE-285: Improper Authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2023-5675",
    "datePublished": "2024-04-25T15:44:55.582Z",
    "dateReserved": "2023-10-20T04:42:22.947Z",
    "dateUpdated": "2025-11-20T18:06:41.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-5675",
      "date": "2026-09-22",
      "epss": "0.00458",
      "percentile": "0.39064"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either \u0027quarkus.security.jaxrs.deny-unannotated-endpoints\u0027 or \u0027quarkus.security.jaxrs.default-roles-allowed\u0027 properties."
        },
        {
          "lang": "es",
          "value": "Se encontr\u00f3 un defecto en Quarkus. Cuando un endpoint Quarkus RestEasy Classic o Reactive JAX-RS tiene sus m\u00e9todos declarados en la clase Java abstracta o personalizados mediante extensiones de Quarkus utilizando el procesador de anotaciones, la autorizaci\u00f3n de estos m\u00e9todos no se aplicar\u00e1 si est\u00e1 habilitada por \u0027quarkus.security.jaxrs.deny-unannotated-endpoints\u0027 o \u0027quarkus.security.jaxrs.default-roles-allowed\u0027."
        }
      ],
      "id": "CVE-2023-5675",
      "lastModified": "2024-11-21T08:42:14.990",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 2.5,
            "source": "secalert@redhat.com",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-04-25T16:15:08.570",
      "references": [
        {
          "source": "secalert@redhat.com",
          "url": "https://access.redhat.com/errata/RHSA-2024:0494"
        },
        {
          "source": "secalert@redhat.com",
          "url": "https://access.redhat.com/errata/RHSA-2024:0495"
        },
        {
          "source": "secalert@redhat.com",
          "url": "https://access.redhat.com/security/cve/CVE-2023-5675"
        },
        {
          "source": "secalert@redhat.com",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245197"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://access.redhat.com/errata/RHSA-2024:0494"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://access.redhat.com/errata/RHSA-2024:0495"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://access.redhat.com/security/cve/CVE-2023-5675"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245197"
        }
      ],
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-285"
            }
          ],
          "source": "secalert@redhat.com",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://mvnrepository.com/artifact/io.quarkus",
                "defaultStatus": "unaffected",
                "packageName": "quarkus-resteasy-reactive",
                "versions": [
                  {
                    "lessThan": "3.2.10.Final",
                    "status": "affected",
                    "version": "3.2.0",
                    "versionType": "maven"
                  },
                  {
                    "lessThan": "3.6.9",
                    "status": "affected",
                    "version": "3.6.0",
                    "versionType": "maven"
                  },
                  {
                    "lessThan": "3.7.1",
                    "status": "affected",
                    "version": "3.7.0",
                    "versionType": "maven"
                  },
                  {
                    "lessThan": "3.8.*",
                    "status": "unaffected",
                    "version": "3.8.0",
                    "versionType": "maven"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:quarkus:2.13"
                ],
                "defaultStatus": "affected",
                "packageName": "io.quarkus/quarkus-resteasy",
                "product": "Red Hat build of Quarkus 2.13.9.Final",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "2.13.9.Final-redhat-00003",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:quarkus:2.13"
                ],
                "defaultStatus": "affected",
                "packageName": "io.quarkus/quarkus-resteasy-reactive",
                "product": "Red Hat build of Quarkus 2.13.9.Final",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "2.13.9.Final-redhat-00003",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:quarkus:3.2"
                ],
                "defaultStatus": "affected",
                "packageName": "io.quarkus/quarkus-resteasy",
                "product": "Red Hat build of Quarkus 3.2.9.Final",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "3.2.9.Final-redhat-00003",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:quarkus:3.2"
                ],
                "defaultStatus": "affected",
                "packageName": "io.quarkus/quarkus-resteasy-reactive",
                "product": "Red Hat build of Quarkus 3.2.9.Final",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "3.2.9.Final-redhat-00003",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:a_mq_clients:2"
                ],
                "defaultStatus": "affected",
                "packageName": "quarkus-resteasy-reactive",
                "product": "A-MQ Clients 2",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:cryostat:2"
                ],
                "defaultStatus": "affected",
                "packageName": "quarkus-resteasy-reactive",
                "product": "Cryostat 2",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:serverless:1"
                ],
                "defaultStatus": "affected",
                "packageName": "quarkus-resteasy-reactive",
                "product": "OpenShift Serverless",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:service_registry:2"
                ],
                "defaultStatus": "affected",
                "packageName": "quarkus-resteasy-reactive",
                "product": "Red Hat build of Apicurio Registry 2",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:optaplanner:::el6"
                ],
                "defaultStatus": "affected",
                "packageName": "quarkus-resteasy-reactive",
                "product": "Red Hat build of OptaPlanner 8",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:jboss_fuse:7"
                ],
                "defaultStatus": "affected",
                "packageName": "quarkus-resteasy-reactive",
                "product": "Red Hat Fuse 7",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:integration:1"
                ],
                "defaultStatus": "affected",
                "packageName": "quarkus-resteasy-reactive",
                "product": "Red Hat Integration Camel K 1",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:camel_quarkus:2"
                ],
                "defaultStatus": "affected",
                "packageName": "quarkus-resteasy-reactive",
                "product": "Red Hat Integration Camel Quarkus 2",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                "cpes": [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8"
                ],
                "defaultStatus": "affected",
                "packageName": "quarkus-resteasy-reactive",
                "product": "Red Hat JBoss Enterprise Application Platform 8",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
                ],
                "defaultStatus": "affected",
                "packageName": "quarkus-resteasy-reactive",
                "product": "Red Hat Process Automation 7",
                "vendor": "Red Hat"
              }
            ],
            "source": "secalert@redhat.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either \u0027quarkus.security.jaxrs.deny-unannotated-endpoints\u0027 or \u0027quarkus.security.jaxrs.default-roles-allowed\u0027 properties."
          },
          {
            "lang": "es",
            "value": "Se encontr\u00f3 un defecto en Quarkus. Cuando un endpoint Quarkus RestEasy Classic o Reactive JAX-RS tiene sus m\u00e9todos declarados en la clase Java abstracta o personalizados mediante extensiones de Quarkus utilizando el procesador de anotaciones, la autorizaci\u00f3n de estos m\u00e9todos no se aplicar\u00e1 si est\u00e1 habilitada por \u0027quarkus.security.jaxrs.deny-unannotated-endpoints\u0027 o \u0027quarkus.security.jaxrs.default-roles-allowed\u0027."
          }
        ],
        "id": "CVE-2023-5675",
        "lastModified": "2026-06-17T06:49:03.253",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 2.5,
              "source": "secalert@redhat.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-5675",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-25T19:40:04.917288Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-25T16:15:08.570",
        "references": [
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2024:0494"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2024:0495"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/security/cve/CVE-2023-5675"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245197"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://access.redhat.com/errata/RHSA-2024:0494"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://access.redhat.com/errata/RHSA-2024:0495"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://access.redhat.com/security/cve/CVE-2023-5675"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245197"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-285"
              }
            ],
            "source": "secalert@redhat.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T21:29:28+00:00",
      "cve": "CVE-2023-5675",
      "id": "CVE-2023-5675",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "4",
      "product_status:known_affected": "10",
      "product_status:known_not_affected": "2041",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "quarkus: Authorization flaw in Quarkus RestEasy Reactive and Classic when \"quarkus.security.jaxrs.deny-unannotated-endpoints\" or \"quarkus.security.jaxrs.default-roles-allowed\" properties are used.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-5675.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T08:07:32.514Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "RHSA-2024:0494",
                "tags": [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
                  "x_transferred"
                ],
                "url": "https://access.redhat.com/errata/RHSA-2024:0494"
              },
              {
                "name": "RHSA-2024:0495",
                "tags": [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
                  "x_transferred"
                ],
                "url": "https://access.redhat.com/errata/RHSA-2024:0495"
              },
              {
                "tags": [
                  "vdb-entry",
                  "x_refsource_REDHAT",
                  "x_transferred"
                ],
                "url": "https://access.redhat.com/security/cve/CVE-2023-5675"
              },
              {
                "name": "RHBZ#2245197",
                "tags": [
                  "issue-tracking",
                  "x_refsource_REDHAT",
                  "x_transferred"
                ],
                "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245197"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-5675",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-04-25T19:40:04.917288Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-04-25T19:39:30.699Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://mvnrepository.com/artifact/io.quarkus",
              "defaultStatus": "unaffected",
              "packageName": "quarkus-resteasy-reactive",
              "versions": [
                {
                  "lessThan": "3.2.10.Final",
                  "status": "affected",
                  "version": "3.2.0",
                  "versionType": "maven"
                },
                {
                  "lessThan": "3.6.9",
                  "status": "affected",
                  "version": "3.6.0",
                  "versionType": "maven"
                },
                {
                  "lessThan": "3.7.1",
                  "status": "affected",
                  "version": "3.7.0",
                  "versionType": "maven"
                },
                {
                  "lessThan": "3.8.*",
                  "status": "unaffected",
                  "version": "3.8.0",
                  "versionType": "maven"
                }
              ]
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:quarkus:2.13"
              ],
              "defaultStatus": "affected",
              "packageName": "io.quarkus/quarkus-resteasy",
              "product": "Red Hat build of Quarkus 2.13.9.Final",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "2.13.9.Final-redhat-00003",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:quarkus:2.13"
              ],
              "defaultStatus": "affected",
              "packageName": "io.quarkus/quarkus-resteasy-reactive",
              "product": "Red Hat build of Quarkus 2.13.9.Final",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "2.13.9.Final-redhat-00003",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:quarkus:3.2"
              ],
              "defaultStatus": "affected",
              "packageName": "io.quarkus/quarkus-resteasy",
              "product": "Red Hat build of Quarkus 3.2.9.Final",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "3.2.9.Final-redhat-00003",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:quarkus:3.2"
              ],
              "defaultStatus": "affected",
              "packageName": "io.quarkus/quarkus-resteasy-reactive",
              "product": "Red Hat build of Quarkus 3.2.9.Final",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "3.2.9.Final-redhat-00003",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:a_mq_clients:2"
              ],
              "defaultStatus": "affected",
              "packageName": "quarkus-resteasy-reactive",
              "product": "A-MQ Clients 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:cryostat:2"
              ],
              "defaultStatus": "affected",
              "packageName": "quarkus-resteasy-reactive",
              "product": "Cryostat 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:serverless:1"
              ],
              "defaultStatus": "affected",
              "packageName": "quarkus-resteasy-reactive",
              "product": "OpenShift Serverless",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:service_registry:2"
              ],
              "defaultStatus": "affected",
              "packageName": "quarkus-resteasy-reactive",
              "product": "Red Hat build of Apicurio Registry 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:optaplanner:::el6"
              ],
              "defaultStatus": "affected",
              "packageName": "quarkus-resteasy-reactive",
              "product": "Red Hat build of OptaPlanner 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:jboss_fuse:7"
              ],
              "defaultStatus": "affected",
              "packageName": "quarkus-resteasy-reactive",
              "product": "Red Hat Fuse 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:integration:1"
              ],
              "defaultStatus": "affected",
              "packageName": "quarkus-resteasy-reactive",
              "product": "Red Hat Integration Camel K 1",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:camel_quarkus:2"
              ],
              "defaultStatus": "affected",
              "packageName": "quarkus-resteasy-reactive",
              "product": "Red Hat Integration Camel Quarkus 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
              "cpes": [
                "cpe:/a:redhat:jboss_enterprise_application_platform:8"
              ],
              "defaultStatus": "affected",
              "packageName": "quarkus-resteasy-reactive",
              "product": "Red Hat JBoss Enterprise Application Platform 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
              ],
              "defaultStatus": "affected",
              "packageName": "quarkus-resteasy-reactive",
              "product": "Red Hat Process Automation 7",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "This issue was discovered by Michal Vav\u0159\u00edk (Red Hat)."
            }
          ],
          "datePublic": "2024-01-24T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either \u0027quarkus.security.jaxrs.deny-unannotated-endpoints\u0027 or \u0027quarkus.security.jaxrs.default-roles-allowed\u0027 properties."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-285",
                  "description": "Improper Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-11-20T18:06:41.381Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "name": "RHSA-2024:0494",
              "tags": [
                "vendor-advisory",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2024:0494"
            },
            {
              "name": "RHSA-2024:0495",
              "tags": [
                "vendor-advisory",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2024:0495"
            },
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2023-5675"
            },
            {
              "name": "RHBZ#2245197",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245197"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2023-10-16T00:00:00+00:00",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2024-01-24T00:00:00+00:00",
              "value": "Made public."
            }
          ],
          "title": "Quarkus: authorization flaw in quarkus resteasy reactive and classic when \"quarkus.security.jaxrs.deny-unannotated-endpoints\" or \"quarkus.security.jaxrs.default-roles-allowed\" properties are used.",
          "workarounds": [
            {
              "lang": "en",
              "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
            }
          ],
          "x_redhatCweChain": "CWE-285: Improper Authorization"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2023-5675",
        "datePublished": "2024-04-25T15:44:55.582Z",
        "dateReserved": "2023-10-20T04:42:22.947Z",
        "dateUpdated": "2025-11-20T18:06:41.381Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.