CVE-2023-6267: high-severity vulnerability in Red Hat build of OptaPlanner 8
Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.7%
A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Affected products
Red Hat · Red Hat build of OptaPlanner 8Red Hat · Red Hat build of Quarkus 2.13.9.FinalRed Hat · Red Hat build of Quarkus 3.2.9.FinalRed Hat · Red Hat Fuse 7Red Hat · Red Hat Integration Camel K 1Red Hat · Red Hat Integration Camel Quarkus 2Related CVEs — Red Hat build of OptaPlanner 8
In the same product, most dangerous first.
CVE-2024-1635HIGHUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolEPSS 4.6%CVE-2023-4853HIGHQuarkus: http security policy bypassEPSS 2.3%CVE-2024-3653MEDIUMUndertow: learningpushhandler can lead to remote memory dos attacksEPSS 1.9%CVE-2024-1023MEDIUMIo.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxEPSS 1.7%CVE-2024-3884HIGHUndertow: outofmemory when parsing form data encoding with application/x-www-form-urlencodedEPSS 1.5%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%