HIGH🇵🇱 Wersja polska

CVE-2023-4853

CVSS 8.1v3.1pub. 2023-09-20upd. 2026-08-04

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Quarkus

    APP
    Quarkus
    < 2.16.113.2.0 – 3.2.6 (excl.)3.3.0 – 3.3.3 (excl.)

  • Red Hat Build Of Optaplanner

    APP
    Redhat
    8.0

  • Red Hat Build Of Quarkus

    APP
    Redhat
    2.13.0 – 2.13.8 (excl.)

  • Red Hat Decision Manager

    APP
    Redhat
    7.0

  • Red Hat Enterprise Linux

    OS
    Redhat
    8.0

  • Red Hat Integration Camel K

    APP
    Redhat
    < 1.10.2

  • Red Hat Integration Camel Quarkus

    APP
    Redhat
    all versions

  • Red Hat Integration Service Registry

    APP
    Redhat
    all versions

  • Red Hat Jboss Middleware

    APP
    Redhat
    1

  • Red Hat Jboss Middleware Text Only Advisories

    APP
    Redhat
    1.0

  • Red Hat OpenShift Container Platform

    APP
    Redhat
    4.104.114.12

  • Red Hat Openshift Serverless

    APP
    Redhat
    1.0

  • Red Hat Process Automation Manager

    APP
    Redhat
    7.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
DoS
CWE
References

Related vulnerabilities

CVE-2025-32463CRITICAL9.3⚠ KEVPL ✓same product

Sudo: eskalacja uprawnień do root poprzez opcję --chroot (CVE-2025-32463)

CVE-2021-40438CRITICAL9.0⚠ KEVPL ✓same product

SSRF w mod_proxy Apache HTTP Server — przekierowanie żądań przez atakującego

CVE-2019-7609CRITICAL10.0⚠ KEVPL ✓same product

RCE w Kibana Timelion — wykonanie kodu z uprawnieniami procesu

CVE-2019-1003029CRITICAL9.9⚠ KEVPL ✓same product

Jenkins Script Security Plugin — sandbox bypass umożliwiający RCE

CVE-2019-1003030CRITICAL9.9⚠ KEVPL ✓same product

Jenkins Pipeline Groovy Plugin — bypass sandbox i wykonanie kodu (RCE)