CVE-2023-0481

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-378 CWE-668

Affected software

Vendor	Product	Versions
n/a	Quarkus	Fixed in 2.16.1

References

https://github.com/quarkusio/quarkus/pull/30694Patch, Vendor Advisory
https://github.com/quarkusio/quarkus/pull/30694Patch, Vendor Advisory

Timeline

Published: Feb 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-04825.5In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates te CVE-2023-04833.8An issue has been discovered in GitLab affecting all versions starting from 12.1 before 15.7.8, all versions starting from 15.8 before 15.8.CVE-2023-04844.3The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activati CVE-2023-04856.5An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9 CVE-2023-04866.1VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance's administrator account via a malicious link. Th CVE-2023-04877.2The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement wh CVE-2023-04885.4Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.CVE-2023-04895.4The SlideOnline WordPress plugin through 1.2.1 does not validate and escape some of its shortcode attributes before outputting them back in CVE-2023-04905.4The f(x) TOC WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a p CVE-2023-04915.4The Schedulicity WordPress plugin through 2.21 does not validate and escape some of its shortcode attributes before outputting them back in CVE-2023-04925.4The GS Products Slider for WooCommerce WordPress plugin before 1.5.9 does not validate and escape some of its shortcode attributes before ou CVE-2023-04938.8Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.