Описание
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
Ссылки
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- MitigationVendor Advisory
- ExploitMitigationTechnical DescriptionVendor Advisory
- Issue TrackingVendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
Одно из
Одновременно
Одно из
EPSS
8.1 High
CVSS3
Дефекты
Связанные уязвимости
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
Quarkus HTTP vulnerable to incorrect evaluation of permissions
Уязвимость политики безопасности HTTP Java-фреймворка Quarkus, позволяющая нарушителю обойти ограничения безопасности, получить несанкционированный доступ к защищаемой информации или вызвать отказ в обслуживании
EPSS
8.1 High
CVSS3