VDB
BDU%3A2023-08669
BDU%3A2023-08669
PUBLISHED
CVSS 7.400000095367432 HIGH
Уязвимость технологии WebSocket Java-фреймворка Quarkus, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации и повысить свои привилегии
Risk Scores
CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat Inc., Сообщество свободного программного обеспечения | Red Hat build of Quarkus, quarkus | |
| Red Hat | Red Hat build of Quarkus 2.13.9.Final | 2.13.9.Final-redhat-00002 |
| Red Hat | Red Hat build of Quarkus 3.2.9.Final | 3.2.9.Final-redhat-00002 |
Timeline
- Dec 9, 2023 CVE Published
- Dec 14, 2023 CVE Updated
- Jan 1, 2024 PoC Published
- May 31, 2026 Distribution Patch
- May 31, 2026 Distribution Patch
- May 31, 2026 Security Advisory
- May 31, 2026 Security Advisory
References
- https://access.redhat.com/security/cve/cve-2023-6394 url
- https://github.com/quarkusio/quarkus/releases/tag/3.5.3 advisory
- https://github.com/quarkusio/quarkus/commit/25ee3bec78c859806ee4733fa486f630cfb38a87 advisory
- RHSA-2023:7612 vendor-advisory
- RHSA-2023:7700 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-6394 vdb
- RHBZ#2252197 issue
- https://github.com/quarkusio/quarkus/issues/20092 url
- https://github.com/quarkusio/quarkus/pull/36961 advisory
- https://github.com/advisories/GHSA-mvc8-6ffp-jrx5 url