CVE-2022-0981: High severity red hat quarkus vulnerability
A flaw was found in Quarkus in versions prior to 2.7.1.Final. State and potentially associated permissions can leak from one web request to another in RestEasy Reactive, leading to the possibility of a low-privileged user to be able to perform operations on the database with a different set of privileges than intended.
Upstream commit: https://github.com/quarkusio/quarkus/pull/23397
Other sources
A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-0981?
CVE-2022-0981 is a vulnerability in Quarkus that allows a low-privileged user to perform unauthorized operations on the database.
What is the severity of CVE-2022-0981?
CVE-2022-0981 has a severity value of 7, which is considered high.
How does CVE-2022-0981 affect Quarkus?
CVE-2022-0981 affects Quarkus versions up to and excluding 2.7.1.
How can I fix CVE-2022-0981 in Quarkus?
To fix CVE-2022-0981, update Quarkus to version 2.7.1 or later.
Where can I find more information about CVE-2022-0981?
You can find more information about CVE-2022-0981 in the following references: [GitHub PR](https://github.com/quarkusio/quarkus/pull/23397), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2022:4623), [Red Hat CVE Database](https://access.redhat.com/security/cve/cve-2022-0981).