Cyber Resilience

CVE-2023-5720

Quarkus 3.0.1 – 3.2.8

Published
15 November 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 7.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS Score 0.0081 54th percentile
Risk Priority 59 floored blend · peak EPSS

Summary

CVE-2023-5720 is a high-severity Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) vulnerability in Quarkus Quarkus. Its CVSS base score is 7.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked in the top 46% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A02:2025 Security Misconfiguration

EU & UK References

Vulnerability Data

A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within…

more

the application.

CWE(s)
CWE-526NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-0481Same product: Quarkus Quarkus
CVE-2023-1584Same product: Quarkus Quarkus
CVE-2024-12225Same product: Quarkus Quarkus
CVE-2025-66560Same product: Quarkus Quarkus
CVE-2023-6267Same product: Quarkus Quarkus
CVE-2026-39852Same product: Quarkus Quarkus
CVE-2026-50559Same product: Quarkus Quarkus
CVE-2023-43029Shared CWE-526
CVE-2024-11736Shared CWE-526
CVE-2026-40153Shared CWE-526

Affected Assets

quarkus
quarkus
3.0.0 · 3.0.1 — 3.2.8

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-01 mostly match
prevents

Encryption and related protections for data-at-rest directly prevent cleartext env-var storage of secrets.

PR.PS-01 partial match
prevents

Hardened configuration baselines and management practices reduce the chance of secrets being left in environment variables.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.24 Use of cryptography mostly match
prevents

Cryptography control directly addresses the lack of encryption for sensitive data stored in environment variables.

A.5.12 Classification of information partial match
mitigates

Classification drives decisions on what must be protected, indirectly discouraging cleartext storage of sensitive data.

A.5.17 Authentication information partial match
mitigates

Authentication secrets are a common type of sensitive information; the control requires protecting them, which this weakness violates.

A.8.10 Information deletion partial match
degrades

Requires secure deletion of sensitive information, which would prevent leaving it in environment variables.

A.8.11 Data masking partial match
mitigates

Data masking techniques can be applied to avoid storing sensitive values in cleartext environment variables.

A.8.12 Data leakage prevention partial match
mitigates

DLP policies can detect and block the placement of sensitive data into environment variables.

References