CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2023-0044
Medium (6.1). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in io.quarkus:quarkus-vertx-http 2.13.7.Final.
If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- quarkus:quarkus
- redhat:build_of_quarkus
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c57v-hc7m-8px2 | Maven | io.quarkus:quarkus-vertx-http | <2.13.7.Final | 2.13.7.Final |