Skip to content
OpenAdvisories
Critical · 9.8 CVE-2022-4116 EUVD-2022-7338GHSA-g56w-cwg4-hxx9

Code injection in quarkus dev ui config editor

Published Nov 22, 2022 · Updated Apr 29, 2025 · Assigned by redhat

Description

A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.

Affected products

VendorProductAffectedFixed
— quarkus quarkus-2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.quarkus:quarkus-vertx-http-deployment >= 2.14.0, < 2.14.2.Final 2.14.2.Final GHSA-g56w-cwg4-hxx9
Maven io.quarkus:quarkus-vertx-http-deployment < 2.13.5.Final 2.13.5.Final GHSA-g56w-cwg4-hxx9

Advisories 2

References