CVE-2023-0044: Cross-Site Request Forgery (CSRF)

February 23, 2023

If the Quarkus Form Authentication session cookie Path attribute is set to / then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.

References

access.redhat.com/security/cve/CVE-2023-0044
bugzilla.redhat.com/show_bug.cgi?id=2158081
github.com/advisories/GHSA-c57v-hc7m-8px2
nvd.nist.gov/vuln/detail/CVE-2023-0044

Code Behaviors & Features

Detect and mitigate CVE-2023-0044 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →