CVE-2023-6267

    Dashboard / Vulnerabilities / CVE-2023-6267

    CVE-2023-6267

    Published: 25 Jan 2024Last Modified: 12 Aug 2026

    Summary: Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.

    Details: A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.

    References: https://access.redhat.com/downloads/content/package-browser/, https://access.redhat.com/errata/RHSA-2024:0494, https://access.redhat.com/errata/RHSA-2024:0495, https://access.redhat.com/security/cve/CVE-2023-6267, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6267.json, https://nvd.nist.gov/vuln/detail/CVE-2023-6267, https://bugzilla.redhat.com/show_bug.cgi?id=2251155

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -1c4c66457ef0a09be0cd79ed1b69fedfa3556775

    Affected versions

    2.13.9-NA

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-6267 | CVE-DB