CVE-2023-5720
Quarkus: build env information disclosure via gradle plugin
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Quarkus: build env information disclosure via gradle plugin
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.
- Record
CVE-2023-5720- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-526
- Updated
- 2026-11-02
EUVDEUVD-2023-3004
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.
- Record
EUVD-2023-3004- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p62q-5483-h57v
Quarkus does not properly sanitize artifacts created from its use of the Gradle plugin, allowing certain build system information to remain
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.
- Record
GHSA-p62q-5483-h57v- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-526
- Updated
- 2026-11-02
NVD
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.
- Record
CVE-2023-5720- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-526
- Updated
- 2026-11-02
OSV
Quarkus: build env information disclosure via gradle plugin
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.
- Record
CVE-2023-5720- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-526
- Updated
- 2026-11-02
OSVGHSA-p62q-5483-h57v
Quarkus does not properly sanitize artifacts created from its use of the Gradle plugin, allowing certain build system information to remain
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.
- Record
GHSA-p62q-5483-h57v- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-526
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.quarkus:quarkus-projectMaven |
3.0.0.CR1 to 3.5.1 | None known |
io.quarkus:quarkus-projectMaven |
3.0.0.CR1 to 3.5.1, plus listed versions 3.1.0.Final3.1.1.Final3.1.2.Final3.1.3.Final3.2.0.CR1 Show 25 moreShow less3.2.0.Final3.2.1.Final3.2.10.Final3.2.11.Final3.2.12.Final3.2.2.Final3.2.3.Final3.2.4.Final3.2.5.Final3.2.6.Final3.2.7.Final3.2.8.Final3.2.9.Final3.3.03.3.0.CR13.3.13.3.23.3.33.4.03.4.0.CR13.4.13.4.23.4.33.5.03.5.0.CR1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-5720 is a high vulnerability (CVSS 7.7) in Quarkus, published November 15, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.81%, the 57th percentile. No source names a fixed version.