Description
If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | quarkus-vertx-http | 1.11.7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.quarkus:quarkus-vertx-http | < 2.13.7.Final | 2.13.7.Final | GHSA-c57v-hc7m-8px2 |
Advisories 1
- WID-SEC-2023-0370 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 23, 2025