CVE-2023-6393

MediumCVSS 5.3/10Last modified Sep 29, 2026

Description

A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to the cached Uni instead of the request context. This is a problem if the cached Uni context contains sensitive information, and could allow a malicious user to benefit from a POST request returning the response that is meant for another user, gaining access to sensitive data.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Dec 6, 2023
Last modified
Sep 29, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-63949.1A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQCVE-2023-63959.8The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbCVE-2023-63975.3A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware vCVE-2023-63987.2A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37CVE-2023-63996.5A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4CVE-2023-64007.4Incorrect Authorization vulnerability in OpenText™ ZENworks Configuration Management (ZCM) allows Unauthorized Use of Device Resources.This CVE-2023-64017.8A vulnerability classified as problematic was found in NotePad++ up to 8.1. Affected by this vulnerability is an unknown functionality of thCVE-2023-64028.8A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknowCVE-2023-64077.1A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary filCVE-2023-64088.1CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a deCVE-2023-64097.7CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to a project file protected with applicatioCVE-2023-64107.5A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via editprofile
CVE-2023-6393: Medium severity, CVSS 5.3 | Vulnix