CVE-2022-4147

—

CVSS 3.1

7.5 high

EPSS

<1%p46

Published

Dec 6, 2022 (Dec 6, 2022)

Modified

Jun 17, 2026

Description

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.

Vendors: quarkus
Products: quarkus
Weakness: CWE-1026
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.