Description

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.

Remediation

References

https://access.redhat.com/security/cve/CVE-2022-4147

Related Vulnerabilities

CVE-2019-10288 Vulnerability in maven package de.e-nexus:jabber-server-plugin

CVE-2020-6506 Vulnerability in npm package react-native-webview

CVE-2022-26850 Vulnerability in maven package org.apache.nifi:nifi-single-user-utils

CVE-2022-22969 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth-parent

CVE-2022-36881 Vulnerability in maven package org.jenkins-ci.plugins:git-client

Severity

High

Classification

CWE-1026 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Vendor Advisory