Description
If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.
Remediation
References
https://access.redhat.com/security/cve/CVE-2023-0044
https://bugzilla.redhat.com/show_bug.cgi?id=2158081
Related Vulnerabilities
CVE-2016-10553 Vulnerability in npm package sequelize
CVE-2022-41928 Vulnerability in maven package org.xwiki.platform:xwiki-platform-attachment-ui
CVE-2022-4565 Vulnerability in maven package cn.hutool:hutool-core
CVE-2022-41777 Vulnerability in npm package nadesiko3
CVE-2023-25569 Vulnerability in maven package com.ctrip.framework.apollo:apollo