CVE-2024-12397highCWE-444

CVE-2024-12397: fallo de gravedad alta en quarkus-http

Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Red Hat build of Keycloak+ Monitorear Red Hat JBoss Enterprise Application Platform Expansion Pack

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.4epss 0.9%
A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
quarkus-httpRed Hat · Cryostat 3Red Hat · Cryostat 4 on RHEL 9Red Hat · HawtIO HawtIO 4.2.0Red Hat · Red Hat build of Apache Camel 4 for Quarkus 3Red Hat · Red Hat build of Apicurio Registry 2Red Hat · Red Hat Build of KeycloakRed Hat · Red Hat build of Keycloak 26.2Red Hat · Red Hat build of OptaPlanner 8Red Hat · Red Hat build of Quarkus 3.15.3Red Hat · Red Hat Fuse 7Red Hat · Red Hat Integration Camel K 1Red Hat · Red Hat JBoss Enterprise Application Platform 8Red Hat · Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat · Red Hat Process Automation 7Red Hat · streams for Apache Kafka
CVEs relacionadas — quarkus-http

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2024-12401MEDIUMCert-manager: potential dos when parsing specially crafted pem inputsEPSS 0.7%CVE-2025-8415MEDIUMCryostat: authentication bypass if network policies are disabledEPSS 0.3%