CVE-2023-5675
Estado: AplazadaMedia (6.5)—
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Puntuación base: 6.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.46%
- Percentil entre todas las CVEs puntuadas: 38
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (3)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-285
Referencias
- https://access.redhat.com/errata/RHSA-2024:0494
- https://access.redhat.com/errata/RHSA-2024:0495
- https://access.redhat.com/security/cve/CVE-2023-5675
- https://bugzilla.redhat.com/show_bug.cgi?id=2245197
- https://access.redhat.com/errata/RHSA-2024:0494
- https://access.redhat.com/errata/RHSA-2024:0495
- https://access.redhat.com/security/cve/CVE-2023-5675
- https://bugzilla.redhat.com/show_bug.cgi?id=2245197
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-5675",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-5675",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-04-25T19:40:04.917288Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.5,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"versions": [
{
"status": "affected",
"version": "3.2.0",
"lessThan": "3.2.10.Final",
"versionType": "maven"
},
{
"status": "affected",
"version": "3.6.0",
"lessThan": "3.6.9",
"versionType": "maven"
},
{
"status": "affected",
"version": "3.7.0",
"lessThan": "3.7.1",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "3.8.0",
"lessThan": "3.8.*",
"versionType": "maven"
}
],
"packageName": "quarkus-resteasy-reactive",
"collectionURL": "https://mvnrepository.com/artifact/io.quarkus",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:quarkus:2.13"
],
"vendor": "Red Hat",
"product": "Red Hat build of Quarkus 2.13.9.Final",
"versions": [
{
"status": "unaffected",
"version": "2.13.9.Final-redhat-00003",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "io.quarkus/quarkus-resteasy",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:quarkus:2.13"
],
"vendor": "Red Hat",
"product": "Red Hat build of Quarkus 2.13.9.Final",
"versions": [
{
"status": "unaffected",
"version": "2.13.9.Final-redhat-00003",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "io.quarkus/quarkus-resteasy-reactive",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:quarkus:3.2"
],
"vendor": "Red Hat",
"product": "Red Hat build of Quarkus 3.2.9.Final",
"versions": [
{
"status": "unaffected",
"version": "3.2.9.Final-redhat-00003",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "io.quarkus/quarkus-resteasy",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:quarkus:3.2"
],
"vendor": "Red Hat",
"product": "Red Hat build of Quarkus 3.2.9.Final",
"versions": [
{
"status": "unaffected",
"version": "3.2.9.Final-redhat-00003",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "io.quarkus/quarkus-resteasy-reactive",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:a_mq_clients:2"
],
"vendor": "Red Hat",
"product": "A-MQ Clients 2",
"packageName": "quarkus-resteasy-reactive",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:cryostat:2"
],
"vendor": "Red Hat",
"product": "Cryostat 2",
"packageName": "quarkus-resteasy-reactive",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"packageName": "quarkus-resteasy-reactive",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:service_registry:2"
],
"vendor": "Red Hat",
"product": "Red Hat build of Apicurio Registry 2",
"packageName": "quarkus-resteasy-reactive",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:optaplanner:::el6"
],
"vendor": "Red Hat",
"product": "Red Hat build of OptaPlanner 8",
"packageName": "quarkus-resteasy-reactive",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"vendor": "Red Hat",
"product": "Red Hat Fuse 7",
"packageName": "quarkus-resteasy-reactive",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:integration:1"
],
"vendor": "Red Hat",
"product": "Red Hat Integration Camel K 1",
"packageName": "quarkus-resteasy-reactive",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:camel_quarkus:2"
],
"vendor": "Red Hat",
"product": "Red Hat Integration Camel Quarkus 2",
"packageName": "quarkus-resteasy-reactive",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"packageName": "quarkus-resteasy-reactive",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"vendor": "Red Hat",
"product": "Red Hat Process Automation 7",
"packageName": "quarkus-resteasy-reactive",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
}
]
}
],
"published": "2024-04-25T16:15:08.570",
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2024:0494",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:0495",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-5675",
"source": "secalert@redhat.com"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245197",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:0494",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:0495",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-5675",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245197",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"description": [
{
"lang": "en",
"value": "CWE-285"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties."
},
{
"lang": "es",
"value": "Se encontró un defecto en Quarkus. Cuando un endpoint Quarkus RestEasy Classic o Reactive JAX-RS tiene sus métodos declarados en la clase Java abstracta o personalizados mediante extensiones de Quarkus utilizando el procesador de anotaciones, la autorización de estos métodos no se aplicará si está habilitada por 'quarkus.security.jaxrs.deny-unannotated-endpoints' o 'quarkus.security.jaxrs.default-roles-allowed'."
}
],
"lastModified": "2026-06-17T06:49:03.253",
"sourceIdentifier": "secalert@redhat.com"
}