PT-2022-6100 · Quarkus · Quarkus

Joseph Beeton · Published 2022-11-22 · Updated 2025-04-29 · CVE-2022-4116

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions quarkus (affected versions not specified)

Description The issue is related to the Dev UI Config Editor component of the quarkus Java framework, which is vulnerable to remote code execution due to incorrect code generation management. This can allow a remote attacker to execute arbitrary code. The vulnerability is also described as being susceptible to drive-by localhost attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Special Elements Injection

Weakness Enumeration

CWE-94

CWE-74

Related Identifiers

BDU:2023-00038

CVE-2022-4116

GHSA-G56W-CWG4-HXX9

Affected Products

Quarkus

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2022-4116 · Security Note
• https://access.redhat.com/security/cve/CVE-2022-4116 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4116 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00038 · Security Note
• https://osv.dev/vulnerability/GHSA-g56w-cwg4-hxx9 · Vendor Advisory
• https://github.com/quarkusio/quarkus · Note
• https://github.com/quarkusio/quarkus/discussions/29527 · Note
• https://github.com/quarkusio/quarkus/discussions/29527#discussioncomment-4387809 · Note
• https://github.com/quarkusio/quarkus/releases/tag/2.14.2.Final · Note
• https://github.com/quarkusio/quarkus/releases/tag/2.13.5.Final · Note
• https://t.me/cvenotify/38256 · Telegram Post
• https://t.me/cibsecurity/53371 · Telegram Post
• https://t.me/cvenotify/120231 · Telegram Post
• https://t.me/cvenotify/38514 · Telegram Post
• https://t.me/pentestingnews/30753 · Telegram Post