CWE-377
Allowed-with-ReviewInsecure Temporary File
Abstraction: Class · Status: Incomplete
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
191 vulnerabilities reference this CWE, most recent first.
GHSA-2MWQ-HCMQ-FQQ4
Vulnerability from github – Published: 2026-08-19 15:32 – Updated: 2026-08-19 15:32phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin contexts to trigger authenticated backups and retrieve the archive.
{
"affected": [],
"aliases": [
"CVE-2026-75920"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-19T14:17:42Z",
"severity": "MODERATE"
},
"details": "phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin contexts to trigger authenticated backups and retrieve the archive.",
"id": "GHSA-2mwq-hcmq-fqq4",
"modified": "2026-08-19T15:32:29Z",
"published": "2026-08-19T15:32:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8hmh-mrx6-pqvf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75920"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/phpmyfaq-before-information-disclosure-via-backup-zip"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2MXR-RC97-XRJ2
Vulnerability from github – Published: 2025-12-09 18:30 – Updated: 2025-12-10 00:02An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "net.sf.robocode:robocode.battle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.5.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-14307"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-10T00:02:37Z",
"nvd_published_at": "2025-12-09T16:17:38Z",
"severity": "CRITICAL"
},
"details": "An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.",
"id": "GHSA-2mxr-rc97-xrj2",
"modified": "2025-12-10T00:02:37Z",
"published": "2025-12-09T18:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14307"
},
{
"type": "WEB",
"url": "https://github.com/robo-code/robocode/pull/68"
},
{
"type": "WEB",
"url": "https://github.com/robo-code/robocode/commit/9f882bba2a9cd91da57c16b98699f8cc9b354f3a"
},
{
"type": "PACKAGE",
"url": "https://github.com/robo-code/robocode"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red",
"type": "CVSS_V4"
}
],
"summary": "Robocode has an insecure temporary file creation vulnerability in the AutoExtract component"
}
GHSA-2W8R-9XJ7-69J5
Vulnerability from github – Published: 2026-07-06 19:50 – Updated: 2026-07-06 19:50The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the current working directory (CWD) instead of the intended secure temporary directory. If the CWD is more permissive or accessible to other users than /tmp, it may lead to unintended information disclosure or unauthorized access to temporary data.
Zellic finding 3.11. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "uu_mktemp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35342"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-06T19:50:41Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the current working directory (CWD) instead of the intended secure temporary directory. If the CWD is more permissive or accessible to other users than /tmp, it may lead to unintended information disclosure or unauthorized access to temporary data.\n\n---\n_Zellic finding 3.11. Reported in the Zellic *uutils coreutils Program Security Assessment* (for Canonical, Jan 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`._",
"id": "GHSA-2w8r-9xj7-69j5",
"modified": "2026-07-06T19:50:41Z",
"published": "2026-07-06T19:50:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/security/advisories/GHSA-2w8r-9xj7-69j5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35342"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/pull/10566"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/commit/eb25ec328b226d8fbbaa4058bf9187165bf06d51"
},
{
"type": "PACKAGE",
"url": "https://github.com/uutils/coreutils"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/releases/tag/0.6.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "mktemp: empty TMPDIR creates temp files in CWD instead of /tmp"
}
GHSA-38H8-X697-GH8Q
Vulnerability from github – Published: 2018-11-09 17:45 – Updated: 2023-09-07 20:13Affected versions of sync-exec use files located in /tmp/ to buffer command results before returning values. As /tmp/ is almost always set with world readable permissions, this may allow low privilege users on the system to read the results of commands run via sync-exec under a higher privilege user.
Recommendation
There is currently no direct patch for sync-exec, as the child_process.execSync function provided in Node.js v0.12.0 and later provides the same functionality natively.
The best mitigation currently is to update to Node.js v0.12.0 or later, and migrate all uses of sync-exec to child_process.execSync().
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "sync-exec"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.6.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-16024"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T20:54:36Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Affected versions of `sync-exec` use files located in `/tmp/` to buffer command results before returning values. As `/tmp/` is almost always set with world readable permissions, this may allow low privilege users on the system to read the results of commands run via `sync-exec` under a higher privilege user.\n\n\n## Recommendation\n\nThere is currently no direct patch for `sync-exec`, as the `child_process.execSync` function provided in Node.js v0.12.0 and later provides the same functionality natively. \n\nThe best mitigation currently is to update to Node.js v0.12.0 or later, and migrate all uses of `sync-exec` to `child_process.execSync()`.",
"id": "GHSA-38h8-x697-gh8q",
"modified": "2023-09-07T20:13:49Z",
"published": "2018-11-09T17:45:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16024"
},
{
"type": "WEB",
"url": "https://github.com/gvarsanyi/sync-exec/issues/17"
},
{
"type": "WEB",
"url": "https://cwe.mitre.org/data/definitions/377.html"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-38h8-x697-gh8q"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/310"
},
{
"type": "WEB",
"url": "https://www.owasp.org/index.php/Insecure_Temporary_File"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Tmp files readable by other users in sync-exec"
}
GHSA-3CGW-CPCX-P7G4
Vulnerability from github – Published: 2026-02-12 00:31 – Updated: 2026-02-17 15:31An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to access user-sensitive data.
{
"affected": [],
"aliases": [
"CVE-2026-20618"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-11T23:16:05Z",
"severity": "MODERATE"
},
"details": "An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to access user-sensitive data.",
"id": "GHSA-3cgw-cpcx-p7g4",
"modified": "2026-02-17T15:31:34Z",
"published": "2026-02-12T00:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20618"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/126348"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3J78-4863-937G
Vulnerability from github – Published: 2026-03-25 03:31 – Updated: 2026-03-25 21:30A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be able to access sensitive user data.
{
"affected": [],
"aliases": [
"CVE-2026-20651"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T01:17:04Z",
"severity": "MODERATE"
},
"details": "A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be able to access sensitive user data.",
"id": "GHSA-3j78-4863-937g",
"modified": "2026-03-25T21:30:28Z",
"published": "2026-03-25T03:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20651"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/126348"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/126350"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/126795"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-47WV-VHJ2-G66M
Vulnerability from github – Published: 2022-03-29 19:18 – Updated: 2024-09-20 21:30Impact
The insecure tempfile.mktemp() is used when Horovod is run in an LSF job with jsrun. In that situation, a jsrun rank file is created with mktemp, which could be hijacked by another process to read or manipulate the content.
This issue does not impact the use of MPI, Gloo, Spark or Ray.
Patches
The problem has been fixed in b96ecae4.
Workarounds
The rank file is not created when binding_args are provided in the Settings instance.
References
Please see https://github.com/horovod/horovod/pull/3358 for details.
For more information
If you have any questions or comments about this advisory: * Open an issue in https://github.com/horovod/horovod
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "horovod"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.24.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-0315"
],
"database_specific": {
"cwe_ids": [
"CWE-377",
"CWE-668"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-29T19:18:32Z",
"nvd_published_at": "2022-03-24T09:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\nThe insecure `tempfile.mktemp()` is used when Horovod is run in an LSF job with `jsrun`. In that situation, a jsrun rank file is created with `mktemp`, which could be hijacked by another process to read or manipulate the content.\n\nThis issue does not impact the use of MPI, Gloo, Spark or Ray.\n\n### Patches\nThe problem has been fixed in [b96ecae4](https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41).\n\n### Workarounds\nThe rank file is not created when `binding_args` are provided in the `Settings` instance.\n\n### References\nPlease see https://github.com/horovod/horovod/pull/3358 for details.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [https://github.com/horovod/horovod](https://github.com/horovod/horovod/issues/new/choose)",
"id": "GHSA-47wv-vhj2-g66m",
"modified": "2024-09-20T21:30:25Z",
"published": "2022-03-29T19:18:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/horovod/horovod/security/advisories/GHSA-47wv-vhj2-g66m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0315"
},
{
"type": "WEB",
"url": "https://github.com/horovod/horovod/pull/3358"
},
{
"type": "WEB",
"url": "https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-47wv-vhj2-g66m"
},
{
"type": "PACKAGE",
"url": "https://github.com/horovod/horovod"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/horovod/PYSEC-2022-175.yaml"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/7e50397b-dd63-4bb5-b56d-704094a7da45"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Use of insecure temporary file in Horovod"
}
GHSA-4QH6-M8H4-CFF3
Vulnerability from github – Published: 2026-07-21 21:32 – Updated: 2026-07-21 21:32A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete system data.
{
"affected": [],
"aliases": [
"CVE-2026-44878"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-21T21:16:49Z",
"severity": "HIGH"
},
"details": "A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device\u0027s filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete system data.",
"id": "GHSA-4qh6-m8h4-cff3",
"modified": "2026-07-21T21:32:42Z",
"published": "2026-07-21T21:32:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44878"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05013en_us\u0026docLocale=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4VP2-6Q8C-PVQ2
Vulnerability from github – Published: 2026-06-25 16:53 – Updated: 2026-06-25 16:53The Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness, or symlink protection. The file was created world-readable (0644) in a world-traversable directory (0755), allowing any local user to read a privileged user's Claude response, which could contain secrets or credentials. Additionally, because the path was static and predictable, a local attacker could pre-create the directory and plant a symlink at the expected file path, causing the privileged process to follow the symlink and overwrite an attacker-chosen file with the response text. Exploiting this required a local unprivileged user on the same system and a privileged user to run the /copy command.
Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.
Claude Code thanks hackerone.com/c_h4ck_0 for reporting this issue.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@anthropic-ai/claude-code"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.59"
},
{
"fixed": "2.1.128"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-46406"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-377",
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-25T16:53:00Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "The Claude Code `/copy` command wrote responses to a hardcoded, predictable path (`/tmp/claude/response.md`) without UID isolation, randomness, or symlink protection. The file was created world-readable (0644) in a world-traversable directory (0755), allowing any local user to read a privileged user\u0027s Claude response, which could contain secrets or credentials. Additionally, because the path was static and predictable, a local attacker could pre-create the directory and plant a symlink at the expected file path, causing the privileged process to follow the symlink and overwrite an attacker-chosen file with the response text. Exploiting this required a local unprivileged user on the same system and a privileged user to run the `/copy` command.\n\nUsers on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.\n\nClaude Code thanks hackerone.com/c_h4ck_0 for reporting this issue.",
"id": "GHSA-4vp2-6q8c-pvq2",
"modified": "2026-06-25T16:53:00Z",
"published": "2026-06-25T16:53:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-4vp2-6q8c-pvq2"
},
{
"type": "PACKAGE",
"url": "https://github.com/anthropics/claude-code"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write"
}
GHSA-53WM-97P6-582F
Vulnerability from github – Published: 2022-05-13 01:07 – Updated: 2026-06-05 17:53A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "instack-undercloud"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-7549"
],
"database_specific": {
"cwe_ids": [
"CWE-377",
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:48:23Z",
"nvd_published_at": "2017-09-21T21:29:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.",
"id": "GHSA-53wm-97p6-582f",
"modified": "2026-06-05T17:53:43Z",
"published": "2022-05-13T01:07:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7549"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2557"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2649"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2687"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2693"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2726"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2017-7549"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1477403"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/instack/PYSEC-2017-152.yaml"
},
{
"type": "WEB",
"url": "https://opendev.org/openstack/instack-undercloud"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20170907040549/http://www.securityfocus.com/bid/100407"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100407"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "instack-undercloud vulnerable to symlink attack on tmp files"
}
No mitigation information available for this CWE.
CAPEC-149: Explore for Predictable Temporary File Names
An attacker explores a target to identify the names and locations of predictable temporary files for the purpose of launching further attacks against the target. This involves analyzing naming conventions and storage locations of the temporary files created by a target application. If an attacker can predict the names of temporary files they can use this information to mount other attacks, such as information gathering and symlink attacks.
CAPEC-155: Screen Temporary Files for Sensitive Information
An adversary exploits the temporary, insecure storage of information by monitoring the content of files used to store temp data during an application's routine execution flow. Many applications use temporary files to accelerate processing or to provide records of state across multiple executions of the application. Sometimes, however, these temporary files may end up storing sensitive information. By screening an application's temporary files, an adversary might be able to discover such sensitive information. For example, web browsers often cache content to accelerate subsequent lookups. If the content contains sensitive information then the adversary could recover this from the web cache.