CVE-2023-6267CWE-755

Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.

High · published January 25, 2024

CVSS v3.1
8.6
EPSS
1%
Percentile
53.4
In the wild
Unconfirmed
What it is

A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00719 · 53.4th percentile
Weakness
CWE-755 · Improper Handling of Exceptional Conditions
Published
2024-01-25T18:12Z
EPSS history
Timeline
  • 25 JAN 18:12Z
    Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.
    cvelistv5