EXPOSURES › CVE-2023-6394

CVE-2023-6394

HIGH

DETAIL

SourceNVD · cve Published2023-12-09 CVSS7.4 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2023-6394 ↗

▸ RECOMMENDED ACTION Patch the affected products and confirm your instances are covered.

PLAYERS IMPLICATED

quarkus · vendor redhat · vendor build of quarkus · product quarkus · product

DESCRIPTION

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.

AFFECTED FEDRAMP PRODUCTS · 0

No correlated FedRAMP products.