CVE-2023-5675 (GCVE-0-2023-5675)

Vulnerability from cvelistv5 – Published: 2024-04-25 15:44 – Updated: 2025-11-20 18:06
VLAI?
Summary
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE
Assigner
References
https://access.redhat.com/errata/RHSA-2024:0494 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:0495 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2023-5675 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2245197 issue-trackingx_refsource_REDHAT
Impacted products
Vendor Product Version
Affected: 3.2.0 , < 3.2.10.Final (maven)
Affected: 3.6.0 , < 3.6.9 (maven)
Affected: 3.7.0 , < 3.7.1 (maven)
Unaffected: 3.8.0 , < 3.8.* (maven)
    Red Hat Red Hat build of Quarkus 2.13.9.Final Unaffected: 2.13.9.Final-redhat-00003 , < * (rpm)
    cpe:/a:redhat:quarkus:2.13
 Create a notification for this product.
    Red Hat Red Hat build of Quarkus 2.13.9.Final Unaffected: 2.13.9.Final-redhat-00003 , < * (rpm)
    cpe:/a:redhat:quarkus:2.13
 Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.2.9.Final Unaffected: 3.2.9.Final-redhat-00003 , < * (rpm)
    cpe:/a:redhat:quarkus:3.2
 Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.2.9.Final Unaffected: 3.2.9.Final-redhat-00003 , < * (rpm)
    cpe:/a:redhat:quarkus:3.2
 Create a notification for this product.
    Red Hat A-MQ Clients 2     cpe:/a:redhat:a_mq_clients:2
 Create a notification for this product.
    Red Hat Cryostat 2     cpe:/a:redhat:cryostat:2
 Create a notification for this product.
    Red Hat OpenShift Serverless     cpe:/a:redhat:serverless:1
 Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 2     cpe:/a:redhat:service_registry:2
 Create a notification for this product.
    Red Hat Red Hat build of OptaPlanner 8     cpe:/a:redhat:optaplanner:::el6
 Create a notification for this product.
    Red Hat Red Hat Fuse 7     cpe:/a:redhat:jboss_fuse:7
 Create a notification for this product.
    Red Hat Red Hat Integration Camel K 1     cpe:/a:redhat:integration:1
 Create a notification for this product.
    Red Hat Red Hat Integration Camel Quarkus 2     cpe:/a:redhat:camel_quarkus:2
 Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 8     cpe:/a:redhat:jboss_enterprise_application_platform:8
 Create a notification for this product.
    Red Hat Red Hat Process Automation 7     cpe:/a:redhat:jboss_enterprise_bpms_platform:7
 Create a notification for this product.
Credits
This issue was discovered by Michal Vavřík (Red Hat).
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-5675",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-25T19:40:04.917288Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-18T18:37:54.897Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:07:32.514Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2024:0494",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0494"
          },
          {
            "name": "RHSA-2024:0495",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0495"
          },
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2023-5675"
          },
          {
            "name": "RHBZ#2245197",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245197"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://mvnrepository.com/artifact/io.quarkus",
          "defaultStatus": "unaffected",
          "packageName": "quarkus-resteasy-reactive",
          "versions": [
            {
              "lessThan": "3.2.10.Final",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "maven"
            },
            {
              "lessThan": "3.6.9",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "maven"
            },
            {
              "lessThan": "3.7.1",
              "status": "affected",
              "version": "3.7.0",
              "versionType": "maven"
            },
            {
              "lessThan": "3.8.*",
              "status": "unaffected",
              "version": "3.8.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:quarkus:2.13"
          ],
          "defaultStatus": "affected",
          "packageName": "io.quarkus/quarkus-resteasy",
          "product": "Red Hat build of Quarkus 2.13.9.Final",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.13.9.Final-redhat-00003",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:quarkus:2.13"
          ],
          "defaultStatus": "affected",
          "packageName": "io.quarkus/quarkus-resteasy-reactive",
          "product": "Red Hat build of Quarkus 2.13.9.Final",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.13.9.Final-redhat-00003",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:quarkus:3.2"
          ],
          "defaultStatus": "affected",
          "packageName": "io.quarkus/quarkus-resteasy",
          "product": "Red Hat build of Quarkus 3.2.9.Final",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3.2.9.Final-redhat-00003",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:quarkus:3.2"
          ],
          "defaultStatus": "affected",
          "packageName": "io.quarkus/quarkus-resteasy-reactive",
          "product": "Red Hat build of Quarkus 3.2.9.Final",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3.2.9.Final-redhat-00003",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:a_mq_clients:2"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "A-MQ Clients 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:cryostat:2"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "Cryostat 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:service_registry:2"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "Red Hat build of Apicurio Registry 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:optaplanner:::el6"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "Red Hat build of OptaPlanner 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_fuse:7"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "Red Hat Fuse 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:integration:1"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "Red Hat Integration Camel K 1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:camel_quarkus:2"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "Red Hat Integration Camel Quarkus 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-resteasy-reactive",
          "product": "Red Hat Process Automation 7",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Michal Vav\u0159\u00edk (Red Hat)."
        }
      ],
      "datePublic": "2024-01-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either \u0027quarkus.security.jaxrs.deny-unannotated-endpoints\u0027 or \u0027quarkus.security.jaxrs.default-roles-allowed\u0027 properties."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-20T18:06:41.381Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:0494",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0494"
        },
        {
          "name": "RHSA-2024:0495",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0495"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2023-5675"
        },
        {
          "name": "RHBZ#2245197",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245197"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-10-16T00:00:00+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-01-24T00:00:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Quarkus: authorization flaw in quarkus resteasy reactive and classic when \"quarkus.security.jaxrs.deny-unannotated-endpoints\" or \"quarkus.security.jaxrs.default-roles-allowed\" properties are used.",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_redhatCweChain": "CWE-285: Improper Authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2023-5675",
    "datePublished": "2024-04-25T15:44:55.582Z",
    "dateReserved": "2023-10-20T04:42:22.947Z",
    "dateUpdated": "2025-11-20T18:06:41.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either \u0027quarkus.security.jaxrs.deny-unannotated-endpoints\u0027 or \u0027quarkus.security.jaxrs.default-roles-allowed\u0027 properties.\"}, {\"lang\": \"es\", \"value\": \"Se encontr\\u00f3 un defecto en Quarkus. Cuando un endpoint Quarkus RestEasy Classic o Reactive JAX-RS tiene sus m\\u00e9todos declarados en la clase Java abstracta o personalizados mediante extensiones de Quarkus utilizando el procesador de anotaciones, la autorizaci\\u00f3n de estos m\\u00e9todos no se aplicar\\u00e1 si est\\u00e1 habilitada por \u0027quarkus.security.jaxrs.deny-unannotated-endpoints\u0027 o \u0027quarkus.security.jaxrs.default-roles-allowed\u0027.\"}]",
      "id": "CVE-2023-5675",
      "lastModified": "2024-11-21T08:42:14.990",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"secalert@redhat.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 2.5}]}",
      "published": "2024-04-25T16:15:08.570",
      "references": "[{\"url\": \"https://access.redhat.com/errata/RHSA-2024:0494\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:0495\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2023-5675\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2245197\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:0494\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:0495\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2023-5675\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2245197\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"secalert@redhat.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-285\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-5675\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2024-04-25T16:15:08.570\",\"lastModified\":\"2024-11-21T08:42:14.990\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either \u0027quarkus.security.jaxrs.deny-unannotated-endpoints\u0027 or \u0027quarkus.security.jaxrs.default-roles-allowed\u0027 properties.\"},{\"lang\":\"es\",\"value\":\"Se encontr\u00f3 un defecto en Quarkus. Cuando un endpoint Quarkus RestEasy Classic o Reactive JAX-RS tiene sus m\u00e9todos declarados en la clase Java abstracta o personalizados mediante extensiones de Quarkus utilizando el procesador de anotaciones, la autorizaci\u00f3n de estos m\u00e9todos no se aplicar\u00e1 si est\u00e1 habilitada por \u0027quarkus.security.jaxrs.deny-unannotated-endpoints\u0027 o \u0027quarkus.security.jaxrs.default-roles-allowed\u0027.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2024:0494\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:0495\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2023-5675\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2245197\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:0494\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:0495\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2023-5675\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2245197\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2024:0494\", \"name\": \"RHSA-2024:0494\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\", \"x_transferred\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:0495\", \"name\": \"RHSA-2024:0495\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\", \"x_transferred\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2023-5675\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\", \"x_transferred\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2245197\", \"name\": \"RHBZ#2245197\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T08:07:32.514Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-5675\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-25T19:40:04.917288Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-04-25T19:39:30.699Z\"}}], \"cna\": {\"title\": \"Quarkus: authorization flaw in quarkus resteasy reactive and classic when \\\"quarkus.security.jaxrs.deny-unannotated-endpoints\\\" or \\\"quarkus.security.jaxrs.default-roles-allowed\\\" properties are used.\", \"credits\": [{\"lang\": \"en\", \"value\": \"This issue was discovered by Michal Vav\\u0159\\u00edk (Red Hat).\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"versions\": [{\"status\": \"affected\", \"version\": \"3.2.0\", \"lessThan\": \"3.2.10.Final\", \"versionType\": \"maven\"}, {\"status\": \"affected\", \"version\": \"3.6.0\", \"lessThan\": \"3.6.9\", \"versionType\": \"maven\"}, {\"status\": \"affected\", \"version\": \"3.7.0\", \"lessThan\": \"3.7.1\", \"versionType\": \"maven\"}, {\"status\": \"unaffected\", \"version\": \"3.8.0\", \"lessThan\": \"3.8.*\", \"versionType\": \"maven\"}], \"packageName\": \"quarkus-resteasy-reactive\", \"collectionURL\": \"https://mvnrepository.com/artifact/io.quarkus\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:quarkus:2.13\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Quarkus 2.13.9.Final\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"2.13.9.Final-redhat-00003\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"io.quarkus/quarkus-resteasy\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quarkus:2.13\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Quarkus 2.13.9.Final\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"2.13.9.Final-redhat-00003\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"io.quarkus/quarkus-resteasy-reactive\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quarkus:3.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Quarkus 3.2.9.Final\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"3.2.9.Final-redhat-00003\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"io.quarkus/quarkus-resteasy\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quarkus:3.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Quarkus 3.2.9.Final\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"3.2.9.Final-redhat-00003\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"io.quarkus/quarkus-resteasy-reactive\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:a_mq_clients:2\"], \"vendor\": \"Red Hat\", \"product\": \"A-MQ Clients 2\", \"packageName\": \"quarkus-resteasy-reactive\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:2\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 2\", \"packageName\": \"quarkus-resteasy-reactive\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"quarkus-resteasy-reactive\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_registry:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 2\", \"packageName\": \"quarkus-resteasy-reactive\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:optaplanner:::el6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of OptaPlanner 8\", \"packageName\": \"quarkus-resteasy-reactive\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"quarkus-resteasy-reactive\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:integration:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Integration Camel K 1\", \"packageName\": \"quarkus-resteasy-reactive\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:camel_quarkus:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Integration Camel Quarkus 2\", \"packageName\": \"quarkus-resteasy-reactive\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8\", \"packageName\": \"quarkus-resteasy-reactive\", \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Process Automation 7\", \"packageName\": \"quarkus-resteasy-reactive\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2023-10-16T00:00:00+00:00\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2024-01-24T00:00:00+00:00\", \"value\": \"Made public.\"}], \"datePublic\": \"2024-01-24T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2024:0494\", \"name\": \"RHSA-2024:0494\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:0495\", \"name\": \"RHSA-2024:0495\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2023-5675\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2245197\", \"name\": \"RHBZ#2245197\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either \u0027quarkus.security.jaxrs.deny-unannotated-endpoints\u0027 or \u0027quarkus.security.jaxrs.default-roles-allowed\u0027 properties.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"Improper Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2025-11-20T18:06:41.381Z\"}, \"x_redhatCweChain\": \"CWE-285: Improper Authorization\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-5675\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-20T18:06:41.381Z\", \"dateReserved\": \"2023-10-20T04:42:22.947Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2024-04-25T15:44:55.582Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.