CVE-2023-5720CWE-526

Quarkus: build env information disclosure via gradle plugin

High · published November 15, 2023

CVSS v3.1
7.7
EPSS
1%
Percentile
56.7
In the wild
Unconfirmed
What it is

A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00815 · 56.7th percentile
Weakness
CWE-526 · Cleartext Storage of Sensitive Information in an Environment Variable
Published
2023-11-15T13:57Z
EPSS history
Timeline
  • 15 NOV 13:57Z
    Quarkus: build env information disclosure via gradle plugin
    cvelistv5