GHSA-9895-g6x5-xwcp

Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed

Source: GitHub Advisory Database (reviewed) High CVE-2022-4147

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.quarkus:quarkus-vertx-http	>= 2.14.0.CR1, < 2.14.2.Final	2.14.2.Final
Maven	io.quarkus:quarkus-vertx-http	< 2.13.5.Final	2.13.5.Final

Details

As written in the advisory (Markdown source, shown as plain text).

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-4147 advisory
https://access.redhat.com/security/cve/CVE-2022-4147 web
https://bugzilla.redhat.com/show_bug.cgi?id=2148867 web
https://github.com/quarkusio/quarkus package
https://quarkus.io/blog/quarkus-2-14-2-final-released web