REDHAT-BUG-2148867: Medium severity Quarkus Quarkus CORS filter vulnerability
Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2148867?
The severity of REDHAT-BUG-2148867 is classified as medium with a score of 4.
How do I fix REDHAT-BUG-2148867?
To fix REDHAT-BUG-2148867, you should update your Quarkus application to the latest version where the CORS filter issue has been addressed.
What vulnerability does REDHAT-BUG-2148867 describe?
REDHAT-BUG-2148867 describes a vulnerability in the Quarkus CORS filter that allows simple GET and POST requests with invalid Origin headers to proceed.
What software is affected by REDHAT-BUG-2148867?
The software affected by REDHAT-BUG-2148867 is the Quarkus CORS filter.
What types of requests are impacted by REDHAT-BUG-2148867?
REDHAT-BUG-2148867 impacts simple GET and POST requests made with XMLHttpRequest that do not have event listeners registered.