CVE-2023-0044: XSS
A flaw was found in Quarkus. If the Quarkus Form Authentication session cookie Path attribute is set to /, then a cross-site attack may be initiated, which might lead to information disclosure.
Other sources
If the Quarkus Form Authentication session cookie Path attribute is set to / then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/quarkus-vertx-httpto a version that resolves this vulnerability.Fixed in 2.13.7 - Configuration
Enable the Quarkus CSRF Prevention feature to prevent the cross-site attack when the Form Authentication session cookie Path attribute is set to '/'. (Applies specifically to cases where the session cookie Path attribute is '/'.)
Quarkus CSRF Prevention feature = enabled
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID of this flaw?
The vulnerability ID of this flaw is CVE-2023-0044.
What is the severity level of CVE-2023-0044?
CVE-2023-0044 has a severity level of medium.
How does this vulnerability affect Quarkus?
This vulnerability affects Quarkus if the Quarkus Form Authentication session cookie Path attribute is set to '/'.
What is the potential risk of this vulnerability?
The potential risk of this vulnerability is cross-site attack which may lead to information disclosure.
How can the Quarkus CSRF Prevention feature help prevent this vulnerability?
The Quarkus CSRF Prevention feature can prevent the cross-site attack and mitigate the risk of information disclosure.