Quarkus: build env information disclosure via gradle plugin
Priority LOW 35CWE-526Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.
Why it matters now
EPSS 0.00815 57th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | gradle-plugin | — | — | No fix listed | CNA |
| — | io.quarkus:quarkus-project (Maven) | 3.0.0.CR1 – 3.5.1 | — | No fix listed | GHSA-p62q-5483-h57v |
- gradle-plugin Vendor— Affected — Fixed in — No fix listed CNA
- io.quarkus:quarkus-project (Maven) Vendor— Affected 3.0.0.CR1 – 3.5.1 Fixed in — No fix listed GHSA-p62q-5483-h57v
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* | 3.0.1 to before 3.2.8 | Vulnerable | quarkusio |
| cpe:2.3:a:quarkus:quarkus:3.0.0:candidate_release1:*:*:*:*:*:* | 3.0.0 candidate_release1 | Vulnerable | quarkusio |
| cpe:2.3:a:quarkus:quarkus:3.0.0:candidate_release2:*:*:*:*:*:* | 3.0.0 candidate_release2 | Vulnerable | quarkusio |
- cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions 3.0.1 to before 3.2.8 Vulnerable ·quarkusio
- cpe:2.3:a:quarkus:quarkus:3.0.0:candidate_release1:*:*:*:*:*:* Versions 3.0.0 candidate_release1 Vulnerable ·quarkusio
- cpe:2.3:a:quarkus:quarkus:3.0.0:candidate_release2:*:*:*:*:*:* Versions 3.0.0 candidate_release2 Vulnerable ·quarkusio
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-5720
- 2026-10-03 Alias added: GHSA-p62q-5483-h57v
References
More quarkusio Quarkus vulnerabilities
- TI-2022-06097 Unchecked Class Instantiation when providing Plugin Classes CVSS 3.1CRITICAL 9.8
- TI-2026-37281 Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities CVSS 3.1HIGH 7.5
- TI-2022-03763 Injection in quarkus CVSS 3.1CRITICAL 9.8
- TI-2020-15666 XML external entity injection in jackson-databind CVSS 3.1HIGH 7.5
- TI-2017-13794 The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load… CVSS 3.1HIGH 7.5
- TI-2021-08126 block repositories using http by default CVSS 3.1CRITICAL 9.1
Sources
- CVE-2023-5720 · CVE Program
- CVE-2023-5720 · NVD
- FIRST EPSS
- GHSA-p62q-5483-h57v · GitHub Advisory Database · CC BY 4.0
- CVE-2023-5720 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences