CVE-2023-6393CWE-200information-disclosure

CVE-2023-6393

Medium · published December 6, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
49.8
In the wild
Unconfirmed
What it is

A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to the cached Uni instead of the request context. This is a problem if the cached Uni context contains sensitive information, and could allow a malicious user to benefit from a POST request returning the response that is meant for another user, gaining access to sensitive data.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00636 · 49.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-12-06T22:15Z
Affected products (1)
ProductVersionsFixed in
redhat/build_of_quarkusall versions—
References (5)
EPSS history
Timeline
  • 06 DEC 16:58Z
    Quarkus: potential invalid reuse of context when @cacheresult on a uni is used
    cvelistv5