CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2023-6393
Medium (5.3) in redhat build of quarkus. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in io.quarkus:quarkus-cache 3.2.9.Final, 3.5.2.
A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to the cached Uni instead of the request context. This is a problem if the cached Uni context contains sensitive information, and could allow a malicious user to benefit from a POST request returning the response that is meant for another user, gaining access to sensitive data.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:build_of_quarkus
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xfv5-jqgp-vqhj | Maven | io.quarkus:quarkus-cache | >=3.3.0.CR1 <3.5.2 | 3.5.2 |
| GHSA-xfv5-jqgp-vqhj | Maven | io.quarkus:quarkus-cache | >=3.2.0.CR1 <3.2.9.Final | 3.2.9.Final |