GHSA-c57v-hc7m-8px2 · Severity: medium · Ecosystem: maven — Cross-site Scripting in Quarkus
If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.
Conclusion & alert: CVE-2023-0044 is rated Low Risk (34.7/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.11%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2025-11-21 | 0.23% | 0.11% | -0.12% |
| 2 | 2025-11-18 | 0.09% | 0.23% | +0.15% |
| 3 | 2025-03-30 | — | 0.09% | — |
Full EPSS history (7 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 6.1 | 3.1 | MEDIUM |
|
2.8 | 2.7 | [email protected] |
GHSA-c57v-hc7m-8px2 · Severity: medium · Ecosystem: maven — Cross-site Scripting in Quarkus
| vendor | priority | summary | link |
|---|---|---|---|
redhat
|
low | — | https://access.redhat.com/security/cve/CVE-2023-0044 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| quarkus | quarkus | < 2.13.7 | cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* |
| redhat | build_of_quarkus | — | cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:* |
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2023-0044 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2158081 | Issue Tracking Third Party Advisory |