CVE-2023-6394

CriticalCVSS 9.1/10Last modified Oct 20, 2026

Description

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Red Hat	Red Hat build of Quarkus 2.13.9	—
Red Hat	Red Hat build of Quarkus 3.2.9.Final	—
Red Hat	Red Hat build of Quarkus	—

References

https://access.redhat.com/errata/RHSA-2023:7612
https://access.redhat.com/errata/RHSA-2023:7700
https://access.redhat.com/security/cve/CVE-2023-6394Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2252197Issue Tracking
https://access.redhat.com/errata/RHSA-2023:7612
https://access.redhat.com/security/cve/CVE-2023-6394Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2252197Issue Tracking

Timeline

Published: Dec 9, 2023
Last modified: Oct 20, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-63959.8The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arb CVE-2023-63975.3A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware v CVE-2023-63987.2A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 CVE-2023-63996.5A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4 CVE-2023-64007.4Incorrect Authorization vulnerability in OpenText™ ZENworks Configuration Management (ZCM) allows Unauthorized Use of Device Resources.This CVE-2023-64017.8A vulnerability classified as problematic was found in NotePad++ up to 8.1. Affected by this vulnerability is an unknown functionality of th CVE-2023-64028.8A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknow CVE-2023-64077.1A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary fil CVE-2023-64088.1CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a de CVE-2023-64097.7CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to a project file protected with applicatio CVE-2023-64107.5A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via editprofile CVE-2023-64117.5A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via home.php in