CVE-2022-4147

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed

High · published December 6, 2022

CVSS v3.1
7.5
EPSS
1%
Percentile
48.8
In the wild
Unconfirmed
What it is

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00616 · 48.8th percentile
Published
2022-12-06T00:00Z
EPSS history
Timeline
  • 06 DEC 00:00Z
    Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed
    cvelistv5