7.7

CVE-2023-5720

Quarkus: build env information disclosure via gradle plugin

A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Quarkus ≫ Quarkus Version >= 3.0.1 < 3.2.8
Quarkus ≫ Quarkus Version3.0.0 Updatecandidate_release1
Quarkus ≫ Quarkus Version3.0.0 Updatecandidate_release2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.71% 0.86
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
secalert@redhat.com 7.7 3.1 4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable

The product uses an environment variable to store unencrypted sensitive information.