CVE-2023-6394

CVSS 3.1 Score 7.4 of 10 (high)

Details

Published Dec 9, 2023
Updated: Dec 20, 2023
CWE ID 862

Summary

CVE-2023-6394 is a vulnerability found in Quarkus, an open-source Java framework. The flaw occurs when receiving a request over a websocket without specifying role-based permission on the GraphQL operation. As a result, Quarkus processes the request without authentication, even if the endpoint is secured. This vulnerability can allow attackers to access information and functionality beyond the granted API permissions. The vulnerability has a high severity rating with a base score of 7.4 and poses a significant danger to organizations, particularly in terms of confidentiality and integrity impacts. Remediating this vulnerability requires implementing proper authorization checks for GraphQL operations within Quarkus applications.

Leverage our Vulnerability Intelligence module to secure your systems now - get detailed insights on CVE-2024-37364. Book your demo today.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-6394 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options