Dashboard / CVE-2023-5675

CVE-2023-5675

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 73/100
Published: 2024-04-25 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: Low
I: Low
A: None

Description

A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
— — 3.2.0 < 3.2.10.Final
— — 3.6.0 < 3.6.9
— — 3.7.0 < 3.7.1

References & Advisories (4)

https://access.redhat.com/errata/RHSA-2024:0494
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:0495
vendor-advisory x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2245197
issue-tracking x_refsource_REDHAT

Bug Bounty Relevance

73 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS — Exploitation Probability

0.46%
Raw Score 0.004580
Percentile 40.3%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00458
2026-11-13
0.00458
2026-11-12
0.00458
2026-11-10
0.00458
2026-11-09
0.00458
2026-11-08
0.00458
2026-11-07
0.00458
2026-11-06
0.00458
2026-11-05
0.00458
2026-11-04
0.00458

Intelligence Sources

mitre ref →
nvd ref →

External Links