by Kastro CVE-2023-6267
Red Hat Red Hat build of Quarkus 2.13.9.Final — Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.
Description · from the CVE record
A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.
Affected
ProductAffectedFixed inSource
Red Hat build of Quarkus 2.13.9.Finalsee advisory2.13.9.Final-redhat-00003CNA
Red Hat build of Quarkus 3.2.9.Finalsee advisory3.2.9.Final-redhat-00003CNA
Red Hat build of OptaPlanner 8see advisory–CNA
Red Hat Fuse 7see advisory–CNA
Red Hat Integration Camel K 1see advisory–CNA
Red Hat Integration Camel Quarkus 2see advisory–CNA
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat (CNA)8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total