PT-2023-16294 · Quarkus · Quarkus

Publicado 2023-02-24 · Atualizado 2025-03-12 · CVE-2023-0481

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Quarkus (affected versions not specified)

Description The issue arises from the use of the insecure File.createTempFile() in the FileBodyHandler class within the RestEasy Reactive implementation of Quarkus. This results in the creation of temporary files with insecure permissions, potentially allowing them to be read by a local user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-378

CWE-668

Identificadores relacionados

CVE-2023-0481

GHSA-J75R-VF64-6RRH

Produtos afetados

Quarkus

Referências · 9

• https://github.com/quarkusio/quarkus · Nota
• https://github.com/quarkusio/quarkus/commit/95d5904f7cf18c8165b97d8ca03b203d7f69c17e · Nota
• https://github.com/quarkusio/quarkus/pull/30694 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-0481 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-0481 · Nota de Segurança
• https://t.me/cvenotify/45687 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-j75r-vf64-6rrh · Aviso do Fabricante
• https://t.me/cvenotify/114478 · Publicação no Telegram
• https://t.me/cibsecurity/58883 · Publicação no Telegram