What is CVE-2023-0481?

CVE-2023-0481 is a low-severity vulnerability in Quarkus, classified under Creation of Temporary File With Insecure Permissions. CVSS score: 3.3/10. Published 2023-02-24.

How severe is CVE-2023-0481?

Low severity. CVSS v3 base score is 3.3 out of 10.

Vulnerability in Quarkus

CVE-2023-0481

In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.

EPSS: 0.002 (10.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Quarkus
N/a Quarkus — versions Fixed in 2.16.1

Weakness classification (CWE)

CWE-378 — Creation of Temporary File With Insecure Permissions
CWE-668 — Exposure of Resource to Wrong Sphere

References

secalert@redhat.com (Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2023-0481?: CVE-2023-0481 is a low-severity vulnerability in Quarkus, classified under Creation of Temporary File With Insecure Permissions. CVSS score: 3.3/10. Published 2023-02-24.
How severe is CVE-2023-0481?: Low severity. CVSS v3 base score is 3.3 out of 10.