Vulnerability Intelligence Report
Quarkus: build env information disclosure via gradle plugin
CVE-2023-5720
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.
No Active Exploit Signals
CVSS Base Score
7.7
HIGH
Exploitability:3.2
Impact Score:4.0
EPSS Probability:0.81%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-526 ↗Cleartext Storage of Sensitive Information in an Environment Variable
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| quarkus | quarkus | 3.0.0 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.815%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Red Hat, Inc. · Vendor · USA |
| Reserved | 2023-10-23T16:39:58 |
| Published | 2023-11-15T13:57:52 |
| Patch Date | 2023-11-08 |
| Last Updated | 2024-08-02T08:07:32 |
Community Chatter & Buzz