CVE-2023-4853 | Quarkus: http security policy bypass

Exp

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Published: 2023-09-20 Last update: 2024-11-21 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2023-4853 is rated High Exploit Risk (69.7/100): CVSS High severity, with medium exploitation likelihood (EPSS 0.46%). 1 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2023-4853

EDB-ID Source Kind Published Link
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2023-4853

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-03-07 0.35% 0.46% +0.11%
2 2025-11-21 4.53% 0.35% -4.18%
3 2025-11-18 — 4.53% —

Full EPSS history (16 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2023-4853

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
8.1 3.1 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 2.2 5.9 [email protected]
8.1 3.1 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 2.2 5.9 [email protected]

Weakness enumeration for CVE-2023-4853

GitHub Security Advisory for CVE-2023-4853

GHSA-4f4r-wgv2-jjvg · Severity: high · Ecosystem: maven — Quarkus HTTP vulnerable to incorrect evaluation of permissions

OS Trackers for CVE-2023-4853

vendor priority summary link
redhat high — https://access.redhat.com/security/cve/CVE-2023-4853

Affected software / configurations for CVE-2023-4853

Vendor Product Version Raw CPE
quarkus quarkus < 2.16.11 cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*
quarkus quarkus >= 3.2.0, < 3.2.6 cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*
quarkus quarkus >= 3.3.0, < 3.3.3 cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*
redhat build_of_optaplanner 8.0 cpe:2.3:a:redhat:build_of_optaplanner:8.0:*:*:*:*:*:*:*
redhat build_of_quarkus >= 2.13.0, < 2.13.8 cpe:2.3:a:redhat:build_of_quarkus:*:*:*:*:text-only:*:*:*
redhat decision_manager 7.0 cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*
redhat integration_camel_k < 1.10.2 cpe:2.3:a:redhat:integration_camel_k:*:*:*:*:*:*:*:*
redhat integration_camel_quarkus — cpe:2.3:a:redhat:integration_camel_quarkus:-:*:*:*:*:*:*:*
redhat integration_service_registry — cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*
redhat jboss_middleware 1 cpe:2.3:a:redhat:jboss_middleware:1:*:*:*:*:*:*:*
redhat jboss_middleware_text-only_advisories 1.0 cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*
redhat openshift_serverless — cpe:2.3:a:redhat:openshift_serverless:-:*:*:*:*:*:*:*
redhat openshift_serverless 1.0 cpe:2.3:a:redhat:openshift_serverless:1.0:*:*:*:*:*:*:*
redhat process_automation_manager 7.0 cpe:2.3:a:redhat:process_automation_manager:7.0:*:*:*:*:*:*:*
redhat openshift_container_platform 4.10 cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*
redhat openshift_container_platform 4.11 cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
redhat openshift_container_platform 4.12 cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*

References for CVE-2023-4853

URL Tags
https://access.redhat.com/errata/RHSA-2023:5170 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5310 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5337 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5446 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5479 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5480 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:6107 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:6112 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:7653 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-4853 Mitigation Vendor Advisory
https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 Exploit Mitigation Technical Description Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2238034 Issue Tracking Vendor Advisory
cvelogic Threat Intelligence