{"id":"CVE-2023-0481","aliases":["EUVD-2023-0730","GHSA-j75r-vf64-6rrh"],"status":"published","title":"RestEasy Reactive implementation of Quarkus allows Creation of Temporary File With Insecure Permissions","description":"In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00206,"percentile":0.10753,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-378","CWE-668"],"published":"2023-02-24T00:00:00Z","modified":"2026-10-28T02:31:01Z","fixes":[{"ecosystem":"Maven","package":"io.quarkus.resteasy.reactive:resteasy-reactive-common","fixed_in":["3.0.0.Alpha4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus.resteasy.reactive:resteasy-reactive-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0.Alpha4"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus.resteasy.reactive:resteasy-reactive-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0.Alpha4"}]}],"versions":["1.11.0.Beta1","1.11.0.Beta2","1.11.0.CR1","1.11.0.Final","1.11.1.Final","1.11.2.Final","1.11.3.Final","1.11.4.Final","1.11.5.Final","1.11.6.Final","1.11.7.Final","1.12.0.CR1","1.12.0.Final","1.12.1.Final","1.12.2.Final","1.13.0.CR1","1.13.0.Final","1.13.1.Final","1.13.2.Final","1.13.3.Final","1.13.4.Final","1.13.5.Final","1.13.6.Final","1.13.7.Final","2.0.0.Alpha1","2.0.0.Alpha2","2.0.0.Alpha3","2.0.0.CR1","2.0.0.CR2","2.0.0.CR3","2.0.0.Final","2.0.1.Final","2.0.2.Final","2.0.3.Final","2.1.0.CR1","2.1.0.Final","2.1.1.Final","2.1.2.Final","2.1.3.Final","2.1.4.Final","2.10.0.CR1","2.10.0.Final","2.10.1.Final","2.10.2.Final","2.10.3.Final","2.10.4.Final","2.11.0.CR1","2.11.0.Final","2.11.1.Final","2.11.2.Final","2.11.3.Final","2.12.0.CR1","2.12.0.Final","2.12.1.Final","2.12.2.Final","2.12.3.Final","2.13.0.CR1","2.13.0.Final","2.13.1.Final","2.13.2.Final","2.13.3.Final","2.13.4.Final","2.13.5.Final","2.13.6.Final","2.13.7.Final","2.13.8.Final","2.13.9.Final","2.14.0.CR1","2.14.0.Final","2.14.1.Final","2.14.2.Final","2.14.3.Final","2.15.0.CR1","2.15.0.Final","2.15.1.Final","2.15.2.Final","2.15.3.Final","2.16.0.CR1","2.16.0.Final","2.16.1.Final","2.16.10.Final","2.16.11.Final","2.16.12.Final","2.16.2.Final","2.16.3.Final","2.16.4.Final","2.16.5.Final","2.16.6.Final","2.16.7.Final","2.16.8.Final","2.16.9.Final","2.2.0.CR1","2.2.0.Final","2.2.1.Final","2.2.2.Final","2.2.3.Final","2.2.4.Final","2.2.5.Final","2.3.0.CR1","2.3.0.Final","2.3.1.Final","2.4.0.CR1","2.4.0.Final","2.4.1.Final","2.4.2.Final","2.5.0.CR1","2.5.0.Final","2.5.1.Final","2.5.2.Final","2.5.3.Final","2.5.4.Final","2.6.0.CR1","2.6.0.Final","2.6.1.Final","2.6.2.Final","2.6.3.Final","2.7.0.CR1","2.7.0.Final","2.7.1.Final","2.7.2.Final","2.7.3.Final","2.7.4.Final","2.7.5.Final","2.7.6.Final","2.7.7.Final","2.8.0.CR1","2.8.0.Final","2.8.1.Final","2.8.2.Final","2.8.3.Final","2.9.0.CR1","2.9.0.Final","2.9.1.Final","2.9.2.Final","3.0.0.Alpha1","3.0.0.Alpha2","3.0.0.Alpha3"]}],"products":[{"vendor":"quarkus","product":"quarkus"},{"vendor":"quarkusio","product":"quarkus"}],"references":[{"url":"https://github.com/quarkusio/quarkus/pull/30694","tags":["x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0481","tags":["advisory"]},{"url":"https://github.com/quarkusio/quarkus/commit/95d5904f7cf18c8165b97d8ca03b203d7f69c17e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j75r-vf64-6rrh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0481.json","tags":["advisory"]},{"url":"https://github.com/quarkusio/quarkus","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-0481","description":"In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.","status":"published","published":"2023-02-24T00:00:00Z","modified":"2025-03-12T15:29:16.755Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-378"],"updated_at":"2026-11-02T14:35:35.256261Z"}],"euvd":[{"id":"EUVD-2023-0730","description":"In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.","status":"published","published":"2023-02-24T00:00:00Z","modified":"2025-03-12T15:29:16Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T20:53:06.438267Z"}],"ghsa":[{"id":"GHSA-j75r-vf64-6rrh","title":"RestEasy Reactive implementation of Quarkus allows Creation of Temporary File With Insecure Permissions","description":"In RestEasy Reactive implementation of Quarkus the insecure `File.createTempFile()` is used in the `FileBodyHandler` class which creates temp files with insecure permissions that could be read by a local user.","status":"published","published":"2023-02-24T18:30:25Z","modified":"2023-11-16T15:17:12Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-378","CWE-668"],"updated_at":"2026-11-02T14:37:22.040291Z"}],"nvd":[{"id":"CVE-2023-0481","description":"In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.","status":"published","published":"2023-02-24T18:15:14.14Z","modified":"2026-06-17T05:25:39.03Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-378","CWE-668"],"updated_at":"2026-11-02T14:07:47.623983Z"}],"osv":[{"id":"CVE-2023-0481","description":"In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.","status":"published","published":"2023-02-24T00:00:00Z","modified":"2026-10-28T02:31:01.423958761Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-378"],"updated_at":"2026-11-02T15:44:29.487253Z"},{"id":"GHSA-j75r-vf64-6rrh","title":"RestEasy Reactive implementation of Quarkus allows Creation of Temporary File With Insecure Permissions","description":"In RestEasy Reactive implementation of Quarkus the insecure `File.createTempFile()` is used in the `FileBodyHandler` class which creates temp files with insecure permissions that could be read by a local user.","status":"published","published":"2023-02-24T18:30:25Z","modified":"2024-02-16T08:19:40.603547Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-378","CWE-668"],"updated_at":"2026-11-02T15:46:49.977351Z"}]}}