Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.
Summary
| CVE | CVE-2023-6267 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-01-25 19:15:08 UTC |
| Updated | 2026-11-04 21:17:26 UTC |
| Description | A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security. |
Risk And Classification
Primary CVSS: v3.1 9.8 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-755 | CWE-755 Improper Handling of Exceptional Conditions
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | [email protected] | Secondary | 8.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H |
| 3.1 | CNA | CVSS | 8.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Build Of Quarkus 2.13.9.Final | unaffected 2.13.9.Final-redhat-00003 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Quarkus 3.2.9.Final | unaffected 3.2.9.Final-redhat-00003 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of OptaPlanner 8 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Fuse 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Integration Camel K 1 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Integration Camel Quarkus 2 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| cve-details | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Vendor Advisory |
| 2251155 – (CVE-2023-6267) CVE-2023-6267 quarkus: json payload getting processed prior to security checks when rest resources are used with annotations. | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Issue Tracking, Vendor Advisory |
| access.redhat.com/errata/RHSA-2024:0495 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0494 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2023-11-23T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2024-01-24T00:00:00.000Z | Made public. |
Legacy QID Mappings
- 997042 Java (Maven) Security Update for io.quarkus.resteasy.reactive:resteasy-reactive (GHSA-8j3x-w35r-rw4r)