CVE-2023-6394: Quarkus: graphql operations over websockets bypass

Description

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 57% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

RH

Red Hat build of Quarkus · Red Hat

All versions, or not specified · source: vendor

RH

Red Hat build of Quarkus 3.2.9.Final · Red Hat

All versions, or not specified · source: vendor

BO

Build OF Quarkus · Redhat

All versions, or not specified · source: NVD

QU

Quarkus · Quarkus

before 3.6.0 · source: NVD