CVE-2023-1584
High
Description
A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.
SeverityHigh
CVSS7.5
Exploit probability—
ProductQuarkus
PublishedOct 4, 2023
First seenOct 4, 2023
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- quarkus quarkus2.13.8 or later
- io.quarkus:quarkus-oidc2.13.0.Final, 3.1.0.Final or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| quarkus quarkus | v < 2.13.8 | 2.13.8 |
| io.quarkus:quarkus-oidcMaven | v < 2.13.0.Final, 3.0.0 ≤ v < 3.1.0.Final | 2.13.0.Final, 3.1.0.Final |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.