CVE-2023-0044: XSS
Published Jan 4, 2023
·Updated
A flaw was found in Quarkus. If the Quarkus Form Authentication session cookie Path attribute is set to `/`, then a cross-site attack may be initiated, which might lead to information disclosure.
Affected Software
3 affected componentsFixes available
redhat/quarkus-vertx-http<2.13.7
2.13.7
Quarkus Quarkus<2.13.7
redhat Build Of Quarkus
Remediation
Information
This attack can be prevented with the Quarkus CSRF Prevention feature.
Event History
Jan 4, 2023
CVE Published
12:00 AM
Data Sourced
12:00 AM
RemedyDescriptionSeverityAffected Software
Feb 23, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this flaw?
The vulnerability ID of this flaw is CVE-2023-0044.
2
What is the severity level of CVE-2023-0044?
CVE-2023-0044 has a severity level of medium.
3
How does this vulnerability affect Quarkus?
This vulnerability affects Quarkus if the Quarkus Form Authentication session cookie Path attribute is set to '/'.
4
What is the potential risk of this vulnerability?
The potential risk of this vulnerability is cross-site attack which may lead to information disclosure.
5
How can the Quarkus CSRF Prevention feature help prevent this vulnerability?
The Quarkus CSRF Prevention feature can prevent the cross-site attack and mitigate the risk of information disclosure.