A critical security vulnerability has been disclosed in the Quarkus Java framework that could be potentially exploited to achieve remote code execution on affected systems.
Tracked as CVE-2022-4116 (CVSS score: 9.8), the shortcoming could be trivially abused by a malicious actor without any privileges.
“The vulnerability is found in the Dev UI Config Editor, which is vulnerable to drive-by localhost attacks that could lead to remote-code execution (RCE),” Contrast Security researcher Joseph Beeton, who reported the bug, said in a write-up.
Quarkus, developed by Red Hat, is an open source project that’s used for creating Java applications in containerized and serverless environments.
images from Hacker News