How severe is CVE-2023-0482?

CVE-2023-0482 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2023-0482 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-0482?

CVE-2023-0482 primarily affects Redhat Resteasy. In total, 8 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-0482?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-0482 published?

CVE-2023-0482 was published on 2023-02-17 and last updated on 2026-06-17.

CVE-2023-0482

CVE-2023-0482 is a medium-severity vulnerability in Redhat Resteasy with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-378.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
EPSS exploit prediction: 1% (53rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-378
Affected product: Redhat Resteasy
Published: 2023-02-17
Last modified: 2026-06-17

Description

In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.

Frequently asked questions

What is CVE-2023-0482?: In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.
How severe is CVE-2023-0482?: CVE-2023-0482 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2023-0482 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-0482?: CVE-2023-0482 primarily affects Redhat Resteasy. In total, 8 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-0482?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-0482 published?: CVE-2023-0482 was published on 2023-02-17 and last updated on 2026-06-17.

References

Affected products (8)

cpe:2.3:a:redhat:resteasy:3.15.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:resteasy:4.7.7:*:*:*:*:*:*:*
cpe:2.3:a:redhat:resteasy:5.0.5:*:*:*:*:*:*:*
cpe:2.3:a:redhat:resteasy:6.2.2:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*

More vulnerabilities in Redhat Resteasy

CVE-2016-9606 — High (CVSS 8.1): JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in…
CVE-2018-1051 — High (CVSS 8.1): It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in…
CVE-2020-14326 — High (CVSS 7.5): A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding,…
CVE-2020-1695 — High (CVSS 7.5): A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to…
CVE-2016-6346 — High (CVSS 7.5): RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors.
CVE-2014-3490 — High (CVSS 7.5): RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP)…

All CVEs affecting Redhat Resteasy →

Other CWE-378 vulnerabilities

CVE-2024-39872 — Critical (CVSS 9.6): A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application…
CVE-2025-32438 — High (CVSS 8.8): make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS…
CVE-2025-27148 — High (CVSS 8.8): Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like…
CVE-2021-29428 — High (CVSS 8.8): In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions…
CVE-2026-33572 — High (CVSS 8.4): OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local…
CVE-2026-4137 — High (CVSS 7.8): In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py`…

Browse all CWE-378 vulnerabilities →