CVE-2022-4147
Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed
Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.
- Record
CVE-2022-4147- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-1026
- Updated
- 2026-11-02
CVE List
Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.
- Record
CVE-2022-4147- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-1026
- Updated
- 2026-11-02
EUVDEUVD-2022-7578
Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.
- Record
EUVD-2022-7578- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9895-g6x5-xwcp
Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed
Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.
- Record
GHSA-9895-g6x5-xwcp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-285
- Updated
- 2026-11-02
OSV
Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.
- Record
CVE-2022-4147- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-1026
- Updated
- 2026-11-02
OSVGHSA-9895-g6x5-xwcp
Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed
Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.
- Record
GHSA-9895-g6x5-xwcp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-285
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.quarkus:quarkus-vertx-httpMaven |
2.14.0.CR1 up to 2.14.2.Final | 2.14.2.Final |
io.quarkus:quarkus-vertx-httpMaven |
before 2.13.5.Final | 2.13.5.Final |
io.quarkus:quarkus-vertx-httpMaven |
2.14.0.CR1 up to 2.14.2.Final, plus listed versions 2.14.0.Final2.14.1.Final |
2.14.2.Final |
io.quarkus:quarkus-vertx-httpMaven |
before 2.13.5.Final, plus listed versions 0.23.00.23.10.23.20.24.00.25.0 Show 45 moreShow less0.26.00.26.10.27.00.28.00.28.11.0.0.CR11.0.0.CR21.0.0.Final1.0.1.Final1.1.0.CR11.1.0.Final1.1.1.Final1.10.0.CR11.10.0.Final1.10.1.Final1.10.2.Final1.10.3.Final1.10.4.Final1.10.5.Final1.11.0.Beta11.11.0.Beta21.11.0.CR11.11.0.Final1.11.1.Final1.11.2.Final1.11.3.Final1.11.4.Final1.11.5.Final1.11.6.Final1.11.7.Final1.12.0.CR11.12.0.Final1.12.1.Final1.12.2.Final1.13.0.CR11.13.0.Final1.13.1.Final1.13.2.Final1.13.3.Final1.13.4.Final1.13.5.Final1.13.6.Final1.13.7.Final1.2.0.CR11.2.0.Final |
2.13.5.Final |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-4147 is a high vulnerability (CVSS 7.5) in Quarkus, published December 6, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 49th percentile. Fixed in io.quarkus:quarkus-vertx-http 2.14.2.Final.
References
access.redhat.com/security/cve/CVE-2022-4147
nvd.nist.gov/vuln/detail/CVE-2022-4147
bugzilla.redhat.com/show_bug.cgi?id=2148867
quarkus.io/blog/quarkus-2-14-2-final-released
github.com/advisories/GHSA-9895-g6x5-xwcp
Left out here: 120 versions. The JSON record has them.