CVE-2023-0044 - Vulnerability Details - OpenCVE

If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Quarkus	Quarkus
Redhat	Build Of Quarkus Quarkus

Configuration 1 [-]

cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat build of Quarkus
	cpe:/a:redhat:quarkus:2.13	RHSA-2023:0758	2023-02-14T00:00:00Z
Red Hat build of Quarkus 2.7.7
io.quarkus/quarkus-vertx-http	cpe:/a:redhat:quarkus:2.7	RHSA-2023:1006	2023-03-08T00:00:00Z

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2023-0044
https://bugzilla.redhat.com/show_bug.cgi?id=2158081
https://github.com/advisories/GHSA-c57v-hc7m-8px2
https://nvd.nist.gov/vuln/detail/CVE-2023-0044
https://www.cve.org/CVERecord?id=CVE-2023-0044

History

Wed, 12 Mar 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2023-02-23T00:00:00.000Z

Updated: 2025-03-12T14:32:14.395Z

Reserved: 2023-01-04T00:00:00.000Z

Link: CVE-2023-0044

Vulnrichment

Updated: 2024-08-02T04:54:32.575Z

NVD

Status : Modified

Published: 2023-02-23T20:15:12.823

Modified: 2024-11-21T07:36:27.050

Link: CVE-2023-0044

Redhat

Severity : Low

Publid Date: 2023-01-04T00:00:00Z

Links: CVE-2023-0044 - Bugzilla

{"acknowledgement": "This issue was discovered by Paulo Lopes (Red Hat).", "affected_release": [{"advisory": "RHSA-2023:0758", "cpe": "cpe:/a:redhat:quarkus:2.13", "product_name": "Red Hat build of Quarkus", "release_date": "2023-02-14T00:00:00Z"}, {"advisory": "RHSA-2023:1006", "cpe": "cpe:/a:redhat:quarkus:2.7", "package": "io.quarkus/quarkus-vertx-http", "product_name": "Red Hat build of Quarkus 2.7.7", "release_date": "2023-03-08T00:00:00Z"}], "bugzilla": {"description": "quarkus-vertx-http: a cross-site attack may be initiated which might lead to the Information Disclosure", "id": "2158081", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158081"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "verified"}, "details": ["If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.", "A flaw was found in Quarkus. If the Quarkus Form Authentication session cookie Path attribute is set to `/`, then a cross-site attack may be initiated, which might lead to information disclosure."], "mitigation": {"lang": "en:us", "value": "This attack can be prevented with the Quarkus CSRF Prevention feature."}, "name": "CVE-2023-0044", "package_state": [{"cpe": "cpe:/a:redhat:a_mq_clients:2", "fix_state": "Not affected", "package_name": "quarkus-vertx-http", "product_name": "A-MQ Clients 2"}, {"cpe": "cpe:/a:redhat:service_registry:2", "fix_state": "Not affected", "package_name": "quarkus-vertx-http", "product_name": "Red Hat build of Apicurio Registry 2"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Not affected", "package_name": "quarkus-vertx-http", "product_name": "Red Hat build of Debezium 1"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Not affected", "package_name": "io.quarkus/quarkus-vertx-http", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "quarkus-vertx-http", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Not affected", "package_name": "quarkus-vertx-http", "product_name": "Red Hat Integration Camel K 1"}, {"cpe": "cpe:/a:redhat:camel_quarkus:2", "fix_state": "Not affected", "package_name": "quarkus-vertx-http", "product_name": "Red Hat Integration Camel Quarkus 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "quarkus-vertx-http", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "quarkus-vertx-http", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7", "fix_state": "Not affected", "package_name": "quarkus-vertx-http", "product_name": "Red Hat Process Automation 7"}], "public_date": "2023-01-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-0044\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-0044\nhttps://github.com/advisories/GHSA-c57v-hc7m-8px2"], "threat_severity": "Low"}