CVE-2022-4147: High severity Quarkus Quarkus vulnerability
A vulnerability was found in Quarkus. The Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest have no event listeners registered on the object returned by the XMLHttpRequest upload property, and have no ReadableStream object used in the request.
Other sources
Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this Quarkus CORS filter vulnerability?
The vulnerability ID for this Quarkus CORS filter vulnerability is CVE-2022-4147.
What is the severity of CVE-2022-4147?
CVE-2022-4147 has a severity level of high.
How does the Quarkus CORS filter vulnerability allow requests with an invalid Origin to proceed?
The Quarkus CORS filter vulnerability allows simple GET and POST requests with an invalid Origin to proceed.
What types of requests are affected by the Quarkus CORS filter vulnerability?
The Quarkus CORS filter vulnerability affects simple GET and POST requests made with XMLHttpRequest.
Are there any event listeners registered on the object returned by the XMLHttpRequest upload property for affected requests?
No, affected simple GET or POST requests made with XMLHttpRequest have no event listeners registered on the object returned by the XMLHttpRequest upload property.