Description

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.

Remediation

References

https://access.redhat.com/security/cve/CVE-2022-4147

Related Vulnerabilities

CVE-2021-44549 Vulnerability in maven package org.apache.sling:org.apache.sling.commons.messaging.mail

CVE-2020-6429 Vulnerability in npm package electron

CVE-2022-23437 Vulnerability in maven package xerces:xercesimpl

CVE-2022-22979 Vulnerability in maven package org.springframework.cloud:spring-cloud-function-parent

CVE-2021-21615 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

Severity

High

Classification

CWE-1026 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Vendor Advisory