Code injection in quarkus dev ui config editor

CRITIQUE 9.8CVE-2022-4116 · GHSA-g56w-cwg4-hxx9 · Published 22/11/2022 · updated 17/06/2026

En bref

CVE-2022-4116 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant io.quarkus:quarkus-vertx-http-deployment, quarkus (quarkus).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 32.5%, plus élevée que 98.3% des vulnérabilités.
Correctif : mettre à jour vers 2.14.2.Final, 2.13.5.Final, 2.14.2, 2.13.5 ou plus récent.

Package	Affected versions	Patched versions
io.quarkus:quarkus-vertx-http-deployment Maven	`≥ 2.14.0, < 2.14.2.Final< 2.13.5.Final`	`2.14.2.Final2.13.5.Final`
quarkus quarkus	`≥ 2.14.0, < 2.14.2< 2.13.5`	`2.14.22.13.5`

Description

A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.

NVD description

A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.

References

nvd.nist.gov/vuln/detail/CVE-2022-4116 · ADVISORY
access.redhat.com/security/cve/CVE-2022-4116 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
quarkusio/quarkus · PACKAGE
quarkusio/quarkus · WEB
quarkusio/quarkus · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free