CVE-2023-33251

medium

Description

When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946.

References

https://doc.akka.io/reference/security-announcements/akka-http-cve-2023-05-15.html

https://akka.io/security/akka-http-cve-2023-05-15.html

Details

Source: Mitre, NVD

Published: 2023-05-21

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5.5

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N