CVE-2023-6393
A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to the cached Uni instead of the request context. This is a problem if the cached Uni context contains sensitive information, and could allow a malicious user to benefit from a POST request returning the response that is meant for another user, gaining access to sensitive data.
Published:Nov 15, 2023
Last Modified:Nov 20, 2025
EPS:Dec 6, 2023
EPSS Score:0.00276
CVSS Score:5.3
Affected Products
Vendor
Product
Action
Vendor
Redhat
Product
Build Of Quarkus
Redhat
Build Of Quarkus
Vendor
Redhat
Product
Quarkus
Redhat
Quarkus
Exploits
No exploit reference
Common Weakness Enumeration
Common Attack Pattern Enumeration and Classification (CAPEC)
Related CVEs
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
