Read the docs
TI-2023-00041 Aliases CVE-2023-0044GHSA-c57v-hc7m-8px2

Cross-site scripting in quarkus-vertx-http

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0055 46th percentileScored 2026-11-07
Fix Fixed io.quarkus:quarkus-vertx-http (Maven): 2.13.7.FinalRed Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—quarkus-vertx-http1.11.7—No fix listedCNA
—io.quarkus:quarkus-vertx-http (Maven)before 2.13.7.Final2.13.7.FinalPatch availableGHSA-c57v-hc7m-8px2
  • quarkus-vertx-http Vendor— Affected 1.11.7 Fixed in — No fix listed CNA
  • io.quarkus:quarkus-vertx-http (Maven) Vendor— Affected before 2.13.7.Final Fixed in 2.13.7.Final Patch available GHSA-c57v-hc7m-8px2

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*before 2.13.7Vulnerablequarkusio
cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 2.13.7 Vulnerable ·quarkusio
  • cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-c57v-hc7m-8px2 io.quarkus:quarkus-vertx-http (Maven) Fixed in 2.13.7.Final Advisory →

Red Hat 2 advisories

  • RHSA-2023:1006 Released 2023-03-08 · Red Hat rating Important
    Red Hat build of Quarkus 2.7.7 release and security update
    • Red Hat build of Quarkus 2.7.7
  • RHSA-2023:0758 Released 2023-02-14 · Red Hat rating Moderate
    Red Hat build of Quarkus 2.13.7 release and security update
    • Red Hat build of Quarkus

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of QuarkusFixed RHSA-2023:0758
Red Hat build of Quarkus 2.7.7Fixed RHSA-2023:1006
Not affected: 10 products
  • A-MQ Clients 2
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Process Automation 7
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Debezium 1
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0044
  2. 2026-10-03 Alias added: GHSA-c57v-hc7m-8px2

References

Advisory 3

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences