CVE-2023-2974

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-757

Affected software

VendorProductVersions
Red HatRed Hat build of Quarkus 2.13.8.Final—
Red HatRed Hat build of Quarkus 2.13.8.Final—

References

Timeline

Published
Jul 4, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-297407.5An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause a denial of service attack by manipulCVE-2023-297419.8An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause an escalation of privileges attack by manipulating the dCVE-2023-297427.8An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a code execution attack by manipulating the database.CVE-2023-297437.5An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating thCVE-2023-297457.1An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating thCVE-2023-297469.8An issue found in The Thaiger v.1.2 for Android allows unauthorized apps to cause a code execution attack by manipulating the SharedPreferenCVE-2023-297479.8Story Saver for Instragram - Video Downloader 1.0.6 for Android exists exposed component, the component provides the method to modify the ShCVE-2023-297487.5Story Saver for Instragram - Video Downloader 1.0.6 for Android has an exposed component that provides a method to modify the SharedPreferenCVE-2023-297497.8An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the CVE-2023-29755.3Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticCVE-2023-297515.5An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SCVE-2023-297527.8An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipul
CVE-2023-2974: High severity, CVSS 8.1 | Vulnix