PT-2023-16294 · Quarkus · Quarkus

Published 2023-02-24 · Updated 2025-03-12 · CVE-2023-0481

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Quarkus (affected versions not specified)

Description The issue arises from the use of the insecure File.createTempFile() in the FileBodyHandler class within the RestEasy Reactive implementation of Quarkus. This results in the creation of temporary files with insecure permissions, potentially allowing them to be read by a local user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-378

CWE-668

Related Identifiers

CVE-2023-0481

GHSA-J75R-VF64-6RRH

Affected Products

Quarkus

References · 9

• https://github.com/quarkusio/quarkus/pull/30694 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0481 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0481 · Security Note
• https://osv.dev/vulnerability/GHSA-j75r-vf64-6rrh · Vendor Advisory
• https://github.com/quarkusio/quarkus · Note
• https://github.com/quarkusio/quarkus/commit/95d5904f7cf18c8165b97d8ca03b203d7f69c17e · Note
• https://t.me/cvenotify/45687 · Telegram Post
• https://t.me/cvenotify/114478 · Telegram Post
• https://t.me/cibsecurity/58883 · Telegram Post