CVE-2022-4147
First published: Mon Nov 28 2022(Updated: )
A vulnerability was found in Quarkus. The Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest have no event listeners registered on the object returned by the XMLHttpRequest upload property, and have no ReadableStream object used in the request.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Quarkus Quarkus | >=2.0<2.13.5 | |
| Quarkus Quarkus | >=2.14.0<2.14.2 | |
| >=2.0<2.13.5 | ||
| >=2.14.0<2.14.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2022-4147
- https://quarkus.io/blog/quarkus-2-14-2-final-released/
- https://quarkusio.zulipchat.com/#narrow/stream/187030-users/topic/CVE-2022-4147
- https://access.redhat.com/errata/RHSA-2022:8957
- https://access.redhat.com/security/cve/cve-2022-4147
- https://access.redhat.com/errata/RHSA-2022:9023
- https://bugzilla.redhat.com/show_bug.cgi?id=2148867
- https://www.cve.org/CVERecord?id=CVE-2022-4147 https://nvd.nist.gov/vuln/detail/CVE-2022-4147
Frequently Asked Questions
What is the vulnerability ID for this Quarkus CORS filter vulnerability?
The vulnerability ID for this Quarkus CORS filter vulnerability is CVE-2022-4147.
What is the severity of CVE-2022-4147?
CVE-2022-4147 has a severity level of high.
How does the Quarkus CORS filter vulnerability allow requests with an invalid Origin to proceed?
The Quarkus CORS filter vulnerability allows simple GET and POST requests with an invalid Origin to proceed.
What types of requests are affected by the Quarkus CORS filter vulnerability?
The Quarkus CORS filter vulnerability affects simple GET and POST requests made with XMLHttpRequest.
Are there any event listeners registered on the object returned by the XMLHttpRequest upload property for affected requests?
No, affected simple GET or POST requests made with XMLHttpRequest have no event listeners registered on the object returned by the XMLHttpRequest upload property.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-4147
- agent/weakness
- agent/severity
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/event
- agent/tags
- agent/trending
- vendor/quarkus
- canonical/quarkus quarkus
- version/quarkus quarkus/2.0
- version/quarkus quarkus/2.14.0