medium6.1
CVE-2023-0044
Cross-site Scripting in Quarkus
Impact
If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.quarkus:quarkus-vertx-http | < 2.13.7.Final | 2.13.7.Final |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Quarkus | Quarkus | before 2.13.7 |
| Redhat | Build Of Quarkus | All versions |