CVE-2023-6267: Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.
A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6267?
CVE-2023-6267 has been classified with a medium severity level due to the potential for security bypass in REST resources.
How do I fix CVE-2023-6267?
To fix CVE-2023-6267, upgrade to io.quarkus.resteasy.reactive version 3.2.9.Final or 2.13.9.Final or later.
What type of vulnerability is CVE-2023-6267?
CVE-2023-6267 is a deserialization vulnerability affecting the JSON payload processing in annotation based security.
Which versions of Quarkus are affected by CVE-2023-6267?
CVE-2023-6267 affects all versions of Red Hat Quarkus from 2.0.0 to 3.2.8 and includes specific versions like 2.13.9 and 3.2.9.
What is the impact of CVE-2023-6267?
The impact of CVE-2023-6267 includes potential unauthorized data access due to security constraints being evaluated after JSON deserialization.