CVE-2023-5675
Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
- Record
CVE-2023-5675- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-285
- Updated
- 2026-11-05
EUVDEUVD-2024-1053
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
- Record
EUVD-2024-1053- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-25w4-hfqg-4r52
Quarkus: authorization flaw in quarkus resteasy reactive and classic
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
While backports of this fix exist in versions 3.6.9 and 3.7.1 users of older versions are encouraged to update to the 3.8.x LTS branch.
- Record
GHSA-25w4-hfqg-4r52- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-285, CWE-287
- Updated
- 2026-11-02
NVD
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
- Record
CVE-2023-5675- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-285
- Updated
- 2026-11-05
OSVGHSA-25w4-hfqg-4r52
Quarkus: authorization flaw in quarkus resteasy reactive and classic
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
While backports of this fix exist in versions 3.6.9 and 3.7.1 users of older versions are encouraged to update to the 3.8.x LTS branch.
- Record
GHSA-25w4-hfqg-4r52- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-285, CWE-287
- Updated
- 2026-11-02
Affected products
- red hat a-mq clients 2
- red hat cryostat 2
- red hat openshift serverless
- red hat build of apicurio registry 2
- red hat build of optaplanner 8
- red hat build of quarkus 2.13.9.final
- red hat build of quarkus 3.2.9.final
- red hat fuse 7
- red hat integration camel k 1
- red hat integration camel quarkus 2
- red hat jboss enterprise application platform 8
- red hat process automation 7
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.quarkus:quarkus-resteasy-reactive-common-deploymentMaven |
before 3.2.10.Final | 3.2.10.Final |
io.quarkus:quarkus-resteasy-reactive-commonMaven |
before 3.2.10.Final | 3.2.10.Final |
io.quarkus:quarkus-resteasy-reactive-common-deploymentMaven |
3.3.0 up to 3.6.9 | 3.6.9 |
io.quarkus:quarkus-resteasy-reactive-commonMaven |
3.3.0 up to 3.6.9 | 3.6.9 |
io.quarkus:quarkus-resteasy-reactive-common-deploymentMaven |
3.7.0 up to 3.7.1 | 3.7.1 |
io.quarkus:quarkus-resteasy-reactive-commonMaven |
3.7.0 up to 3.7.1 | 3.7.1 |
io.quarkus:quarkus-resteasy-reactive-common-deploymentMaven |
before 3.2.10.Final, plus listed versions 1.11.0.Beta11.11.0.Beta21.11.0.CR11.11.0.Final1.11.1.Final Show 45 moreShow less1.11.2.Final1.11.3.Final1.11.4.Final1.11.5.Final1.11.6.Final1.11.7.Final1.12.0.CR11.12.0.Final1.12.1.Final1.12.2.Final1.13.0.CR11.13.0.Final1.13.1.Final1.13.2.Final1.13.3.Final1.13.4.Final1.13.5.Final1.13.6.Final1.13.7.Final2.0.0.Alpha12.0.0.Alpha22.0.0.Alpha32.0.0.CR12.0.0.CR22.0.0.CR32.0.0.Final2.0.1.Final2.0.2.Final2.0.3.Final2.1.0.CR12.1.0.Final2.1.1.Final2.1.2.Final2.1.3.Final2.1.4.Final2.10.0.CR12.10.0.Final2.10.1.Final2.10.2.Final2.10.3.Final2.10.4.Final2.11.0.CR12.11.0.Final2.11.1.Final2.11.2.Final |
3.2.10.Final |
io.quarkus:quarkus-resteasy-reactive-commonMaven |
before 3.2.10.Final, plus listed versions 1.11.0.Beta11.11.0.Beta21.11.0.CR11.11.0.Final1.11.1.Final Show 45 moreShow less1.11.2.Final1.11.3.Final1.11.4.Final1.11.5.Final1.11.6.Final1.11.7.Final1.12.0.CR11.12.0.Final1.12.1.Final1.12.2.Final1.13.0.CR11.13.0.Final1.13.1.Final1.13.2.Final1.13.3.Final1.13.4.Final1.13.5.Final1.13.6.Final1.13.7.Final2.0.0.Alpha12.0.0.Alpha22.0.0.Alpha32.0.0.CR12.0.0.CR22.0.0.CR32.0.0.Final2.0.1.Final2.0.2.Final2.0.3.Final2.1.0.CR12.1.0.Final2.1.1.Final2.1.2.Final2.1.3.Final2.1.4.Final2.10.0.CR12.10.0.Final2.10.1.Final2.10.2.Final2.10.3.Final2.10.4.Final2.11.0.CR12.11.0.Final2.11.1.Final2.11.2.Final |
3.2.10.Final |
io.quarkus:quarkus-resteasy-reactive-common-deploymentMaven |
3.3.0 up to 3.6.9, plus listed versions 3.3.13.3.23.3.33.4.03.4.0.CR1 Show 18 moreShow less3.4.13.4.23.4.33.5.03.5.0.CR13.5.13.5.23.5.33.6.03.6.0.CR13.6.13.6.23.6.33.6.43.6.53.6.63.6.73.6.8 |
3.6.9 |
io.quarkus:quarkus-resteasy-reactive-commonMaven |
3.3.0 up to 3.6.9, plus listed versions 3.3.13.3.23.3.33.4.03.4.0.CR1 Show 18 moreShow less3.4.13.4.23.4.33.5.03.5.0.CR13.5.13.5.23.5.33.6.03.6.0.CR13.6.13.6.23.6.33.6.43.6.53.6.63.6.73.6.8 |
3.6.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-5675 is a medium vulnerability (CVSS 6.5) in Red Hat A-mq Clients 2, published April 25, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in io.quarkus:quarkus-resteasy-reactive-common-deployment 3.2.10.Final.
References
access.redhat.com/errata/RHSA-2024:0494
bugzilla.redhat.com/show_bug.cgi?id=2245197
nvd.nist.gov/vuln/detail/CVE-2023-5675
github.com/quarkusio/quarkus/commit/d802748128cd1932279b7c334f3792d481814ef5
Show 5 moreShow less
Left out here: 228 versions. The JSON record has them.