CVE-2023-6267

CriticalCVSS 9.8/10Last modified Nov 4, 2026

Description

A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-755

Affected software

VendorProductVersions
Red HatRed Hat build of Quarkus 2.13.9.Final—
Red HatRed Hat build of Quarkus 3.2.9.Final—
Red HatRed Hat build of OptaPlanner 8—
Red HatRed Hat Fuse 7—
Red HatRed Hat Integration Camel K 1—
Red HatRed Hat Integration Camel Quarkus 2—

References

Timeline

Published
Jan 25, 2024
Last modified
Nov 4, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-62686.1The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the pageCVE-2023-62699.8An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products "Session BCVE-2023-62707.0A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on CVE-2023-62717.5The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which CVE-2023-62729.8The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force aCVE-2023-62735.3Permission management vulnerability in the module for disabling Sound Booster. Successful exploitation of this vulnerability may cause featuCVE-2023-62749.8A vulnerability was found in Byzoro Smart S80 up to 20231108. It has been declared as critical. Affected by this vulnerability is an unknownCVE-2023-62756.1A vulnerability was found in TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1. It has been rated as problematic. Affected by this issue is some CVE-2023-62767.5A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file general/wiki/cpCVE-2023-62776.5An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of sCVE-2023-62786.1The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin before 2.2.25 does not sanitise and escape the biteship_errCVE-2023-62797.1The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, su
CVE-2023-6267: Critical severity, CVSS 9.8 | Vulnix