CVE-2023-5720: Quarkus: build env information disclosure via gradle plugin
First published: Mon Oct 23 2023(Updated: )
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/io.quarkus:quarkus-project | >=3.0.0.CR1<=3.5.1 | |
| Quarkus Quarkus | >=3.0.1 | |
| Quarkus Quarkus | =3.0.0-candidate_release1 | |
| Quarkus Quarkus | =3.0.0-candidate_release2 | |
| Quarkus Quarkus | >=3.0.1<3.2.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-5720?
CVE-2023-5720 is a vulnerability that allows an attacker to access potentially sensitive information from the build system within the Quarkus application.
What is the severity of CVE-2023-5720?
CVE-2023-5720 has a severity rating of 7.7, which is considered high.
How does CVE-2023-5720 affect Quarkus?
CVE-2023-5720 affects Quarkus versions ranging from 3.0.0.CR1 to 3.5.1
How can I fix CVE-2023-5720?
To fix CVE-2023-5720, it is recommended to update Quarkus to a version that is not affected by the vulnerability.
Where can I find more information about CVE-2023-5720?
More information about CVE-2023-5720 can be found at the following references: [Link 1](https://access.redhat.com/security/cve/CVE-2023-5720), [Link 2](https://bugzilla.redhat.com/show_bug.cgi?id=2245700), and [Link 3](https://nvd.nist.gov/vuln/detail/CVE-2023-5720).
- collector/github-advisory-latest
- alias/GHSA-p62q-5483-h57v
- alias/CVE-2023-5720
- collector/github-advisory
- collector/nvd-cve
- collector/nvd-api
- agent/references
- agent/author
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/title
- agent/weakness
- agent/severity
- agent/description
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- package-manager/maven
- vendor/quarkus
- canonical/quarkus quarkus
- version/quarkus quarkus/3.0.1
- version/quarkus quarkus/3.0.0-candidate_release1
- version/quarkus quarkus/3.0.0-candidate_release2