CVE-2023-1584

Katalog CVE

CVSS 7.5 · High EPSS 0,96%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada quarkus. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.

Rincian

Terbit di NVD

4 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,96% peluang dieksploitasi; lebih tinggi dari 60,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/quarkusio/quarkus/pull/32192 advisory vendor
• https://github.com/quarkusio/quarkus/pull/33414 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:3809 advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2023-1584 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2180886 issue tracking · advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2023:7653