CVE-2023-33251

When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.7 MEDIUM
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
mitreCNA
4.7 MEDIUM
LOCAL
HIGH
LOW
CVSS:3.1/AC:H/AV:L/A:N/C:H/I:N/PR:L/S:U/UI:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 13%
VendorProductVersion
lightbendakka_http
𝑥
< 10.5.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://akka.io/security/akka-http-cve-2023-05-15.html
https://akka.io/security/akka-http-cve-2023-05-15.html
https://doc.akka.io/reference/security-announcements/akka-http-cve-2023-05-15.html