Code injection in quarkus dev ui config editor

CRITICAL 9.8CVE-2022-4116 · GHSA-g56w-cwg4-hxx9 · Published 22/11/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
io.quarkus:quarkus-vertx-http-deployment Maven	`≥ 2.14.0, < 2.14.2.Final< 2.13.5.Final`	`2.14.2.Final2.13.5.Final`
quarkus quarkus	`≥ 2.14.0, < 2.14.2< 2.13.5`	`2.14.22.13.5`

Description

A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.

NVD description

A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.

References

nvd.nist.gov/vuln/detail/CVE-2022-4116 · ADVISORY
access.redhat.com/security/cve/CVE-2022-4116 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
quarkusio/quarkus · PACKAGE
quarkusio/quarkus · WEB
quarkusio/quarkus · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free