CVE-2022-4116 — Code injection in...

CRITICAL

Code injection in quarkus dev ui config editor

Published November 22, 2022Updated November 8, 2023Source: osv

Summary

A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.

Advisory Timeline

First published November 22, 2022 (1420 days ago).
Last revised November 8, 2023 — 350 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update io.quarkus:quarkus-vertx-http-deployment to 2.13.5.Final or later

<!-- Update pom.xml dependency version to 2.13.5.Final for io.quarkus:quarkus-vertx-http-deployment -->

Maven

Update io.quarkus:quarkus-vertx-http-deployment to 2.14.2.Final or later

<!-- Update pom.xml dependency version to 2.14.2.Final for io.quarkus:quarkus-vertx-http-deployment -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: maven (1).

Package	Ecosystem	Affected	Fixed In
io.quarkus:quarkus-vertx-http-deployment	maven	0.23.0, 0.23.1, 0.23.2, 0.24.0 (+166 more)	2.13.5.Final
io.quarkus:quarkus-vertx-http-deployment	maven	2.14.0.Final, 2.14.1.Final	2.14.2.Final

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-74
View on MITRE
CWE-94
Code InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2022-4116?: Code injection in quarkus dev ui config editor This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2022-4116?: CVE-2022-4116 affects io.quarkus:quarkus-vertx-http-deployment. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-4116 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-g56w-cwg4-hxx9

Related CVEs

CVE-2026-107726
CRITICAL
Hazelcast allows arbitrary member memory access by low-privileged client
CVE-2026-107282
CRITICAL
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
CVE-2023-4853
HIGH
Quarkus HTTP vulnerable to incorrect evaluation of permissions
CVE-2025-1247
HIGH
Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance
CVE-2026-50559
HIGH
Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
CVE-2026-39852
HIGH
Quarkus has Authentication/Authorization bypasses

More Maven advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies