CVE-2023-4853

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://access.redhat.com/errata/RHSA-2023:5310", "name": "https://access.redhat.com/errata/RHSA-2023:5310", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://access.redhat.com/security/cve/CVE-2023-4853", "name": "https://access.redhat.com/security/cve/CVE-2023-4853", "tags": ["Mitigation", "Vendor Advisory"], "refsource": "MISC"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2238034", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2238034", "tags": ["Issue Tracking", "Vendor Advisory"], "refsource": "MISC"}, {"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-002", "name": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-002", "tags": ["Exploit", "Mitigation", "Technical Description", "Vendor Advisory"], "refsource": "MISC"}, {"url": "https://access.redhat.com/errata/RHSA-2023:5170", "name": "https://access.redhat.com/errata/RHSA-2023:5170", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://access.redhat.com/errata/RHSA-2023:5337", "name": "https://access.redhat.com/errata/RHSA-2023:5337", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://access.redhat.com/errata/RHSA-2023:5446", "name": "https://access.redhat.com/errata/RHSA-2023:5446", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://access.redhat.com/errata/RHSA-2023:5479", "name": "https://access.redhat.com/errata/RHSA-2023:5479", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://access.redhat.com/errata/RHSA-2023:5480", "name": "https://access.redhat.com/errata/RHSA-2023:5480", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://access.redhat.com/errata/RHSA-2023:6107", "name": "https://access.redhat.com/errata/RHSA-2023:6107", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://access.redhat.com/errata/RHSA-2023:6112", "name": "https://access.redhat.com/errata/RHSA-2023:6112", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://access.redhat.com/errata/RHSA-2023:7653", "name": "RHSA-2023:7653", "tags": ["Vendor Advisory"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-863"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2023-4853", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}}, "publishedDate": "2023-09-20T10:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "3.3.3", "versionStartIncluding": "3.3.0"}, {"cpe23Uri": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "3.2.6", "versionStartIncluding": "3.2.0"}, {"cpe23Uri": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.16.11"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:jboss_middleware:1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:integration_camel_quarkus:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:build_of_quarkus:*:*:*:*:text-only:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.13.8", "versionStartIncluding": "2.13.0"}, {"cpe23Uri": "cpe:2.3:a:redhat:openshift_serverless:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:integration_camel_k:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.10.2"}, {"cpe23Uri": "cpe:2.3:a:redhat:process_automation_manager:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:build_of_optaplanner:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:openshift_serverless:1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-12-21T01:02Z"}