GHSA-9895-g6x5-xwcp

ghsaUSosv

Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed

view advisory published 2022-12-06Licence: CC-BY-4.0

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-4147US	high7.5	0.62% (49th)	—	2022-12-06
Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listen…

references

External citations — patches, advisories, analysis.

https://access.redhat.com/security/cve/CVE-2022-4147WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2148867WEB
https://github.com/quarkusio/quarkusPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2022-4147ADVISORY
https://quarkus.io/blog/quarkus-2-14-2-final-releasedWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan