Read the docs
TI-2023-00455 Aliases CVE-2023-0481GHSA-j75r-vf64-6rrh

Exposure of resource to wrong sphere in Quarkus

Priority LOW 15CWE-378Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-668 and the CVSS impact.

Summary

In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00206 10th percentileScored 2026-11-07
Fix Fixed io.quarkus.resteasy.reactive:resteasy-reactive-common (Maven): 3.0.0.Alpha4Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—QuarkusFixed in 2.16.1—No fix listedCNA
—io.quarkus.resteasy.reactive:resteasy-reactive-common (Maven)before 3.0.0.Alpha43.0.0.Alpha4Patch availableGHSA-j75r-vf64-6rrh
  • Quarkus Vendor— Affected Fixed in 2.16.1 Fixed in — No fix listed CNA
  • io.quarkus.resteasy.reactive:resteasy-reactive-common (Maven) Vendor— Affected before 3.0.0.Alpha4 Fixed in 3.0.0.Alpha4 Patch available GHSA-j75r-vf64-6rrh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*before 2.16.1Vulnerablequarkusio
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 2.16.1 Vulnerable ·quarkusio

Remediation

  • Fix · GHSA-j75r-vf64-6rrh io.quarkus.resteasy.reactive:resteasy-reactive-common (Maven) Fixed in 3.0.0.Alpha4 Advisory →

Red Hat 1 advisory

  • RHSA-2023:3809 Released 2023-06-29 · Red Hat rating Moderate
    Red Hat build of Quarkus 2.13.8 release and security update
    • Red Hat build of Quarkus 2.13.8.Final com.graphql-java.graphql-java-19.4.0.redhat-00001.jar, io.quarkus.quarkus-grpc-2.13.8.Final-redhat-00004.jar, io.quarkus.quarkus-oidc-2.13.8.Final-redhat-00004.jar +3

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of Quarkus 2.13.8.FinalFixed RHSA-2023:3809
Not affected: 1 product
  • Red Hat build of Quarkus 2.13.8.Final

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0481
  2. 2026-10-03 Alias added: GHSA-j75r-vf64-6rrh

References

Patch 1

Advisory 1

Other 2

  • TI-2022-06097 Unchecked Class Instantiation when providing Plugin Classes CVSS 3.1CRITICAL 9.8
  • TI-2026-37281 Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities CVSS 3.1HIGH 7.5
  • TI-2022-03763 Injection in quarkus CVSS 3.1CRITICAL 9.8
  • TI-2020-15666 XML external entity injection in jackson-databind CVSS 3.1HIGH 7.5
  • TI-2017-13794 The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load… CVSS 3.1HIGH 7.5
  • TI-2021-08126 block repositories using http by default CVSS 3.1CRITICAL 9.1
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences