Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-6394

Good to know:

icon
icon

Date: December 8, 2023

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.

Language: Java

Severity Score

Related Resources (10)

https://access.redhat.com/errata/RHSA-2023:7612
https://access.redhat.com/errata/RHSA-2023:7700
https://github.com/quarkusio/quarkus/pull/36961
https://bugzilla.redhat.com/show_bug.cgi?id=2252197
https://github.com/quarkusio/quarkus
https://github.com/quarkusio/quarkus/releases/tag/2.13.9.Final
https://github.com/quarkusio/quarkus/releases/tag/3.5.3
https://access.redhat.com/security/cve/CVE-2023-6394
https://nvd.nist.gov/vuln/detail/CVE-2023-6394
https://www.mend.io/vulnerability-database/CVE-2023-6394

Severity Score

Weakness Type (CWE)

Missing Authorization

CWE-862

Incorrect Behavior Order

CWE-696

Top Fix

icon

Upgrade Version

Upgrade to version io.quarkus:quarkus-smallrye-graphql:3.6.0, io.quarkus:quarkus-smallrye-graphql-deployment:3.6.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us