CWE-377
Allowed-with-ReviewInsecure Temporary File
Abstraction: Class · Status: Incomplete
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
191 vulnerabilities reference this CWE, most recent first.
GHSA-58X3-7493-RJR4
Vulnerability from github – Published: 2026-08-13 15:34 – Updated: 2026-08-13 15:34A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the /tmp directory. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to an arbitrary file. This can lead to privileged file corruption or a denial of service (DoS) on the system.
{
"affected": [],
"aliases": [
"CVE-2026-73584"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T13:19:18Z",
"severity": "MODERATE"
},
"details": "A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the `/tmp` directory. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to an arbitrary file. This can lead to privileged file corruption or a denial of service (DoS) on the system.",
"id": "GHSA-58x3-7493-rjr4",
"modified": "2026-08-13T15:34:37Z",
"published": "2026-08-13T15:34:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73584"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-73584"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462721"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5MP3-VQFJ-W7MQ
Vulnerability from github – Published: 2022-09-21 00:00 – Updated: 2022-09-23 00:00In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript uses a PID file that is writable by the smokeping user. By writing arbitrary PIDs to that file, the smokeping user can cause a denial of service to arbitrary PIDs when the service is stopped.
{
"affected": [],
"aliases": [
"CVE-2017-20147"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-20T18:15:00Z",
"severity": "MODERATE"
},
"details": "In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript uses a PID file that is writable by the smokeping user. By writing arbitrary PIDs to that file, the smokeping user can cause a denial of service to arbitrary PIDs when the service is stopped.",
"id": "GHSA-5mp3-vqfj-w7mq",
"modified": "2022-09-23T00:00:43Z",
"published": "2022-09-21T00:00:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-20147"
},
{
"type": "WEB",
"url": "https://bugs.gentoo.org/631140"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202209-08"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5QVP-PR9F-2G2V
Vulnerability from github – Published: 2026-04-01 20:52 – Updated: 2026-04-01 20:52Pin vulnerable version of requests library
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.5.5"
},
"package": {
"ecosystem": "PyPI",
"name": "poetry-plugin-tweak-dependencies-version"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-01T20:52:20Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Pin vulnerable version of requests library",
"id": "GHSA-5qvp-pr9f-2g2v",
"modified": "2026-04-01T20:52:21Z",
"published": "2026-04-01T20:52:20Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"
},
{
"type": "WEB",
"url": "https://github.com/sbrunner/poetry-plugin-tweak-dependencies-version/security/advisories/GHSA-5qvp-pr9f-2g2v"
},
{
"type": "WEB",
"url": "https://github.com/sbrunner/poetry-plugin-tweak-dependencies-version/commit/54b5784d89f36cd413a8bc5032ab0a96438dcae3"
},
{
"type": "PACKAGE",
"url": "https://github.com/sbrunner/poetry-plugin-tweak-dependencies-version"
},
{
"type": "WEB",
"url": "https://github.com/sbrunner/poetry-plugin-tweak-dependencies-version/releases/tag/1.5.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "poetry-plugin-tweak-dependencies-version affected by CVE-2026-25645"
}
GHSA-67V8-88JF-4X6Q
Vulnerability from github – Published: 2026-06-29 12:31 – Updated: 2026-07-01 15:34GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.
This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269
{
"affected": [],
"aliases": [
"CVE-2026-41991"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-29T12:16:29Z",
"severity": "LOW"
},
"details": "GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user\u2019s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre\u2011create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time\u2011of\u2011check to time\u2011of\u2011use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269",
"id": "GHSA-67v8-88jf-4x6q",
"modified": "2026-07-01T15:34:56Z",
"published": "2026-06-29T12:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41991"
},
{
"type": "WEB",
"url": "https://cert.pl/en/posts/2026/04/CVE-2026-41991"
},
{
"type": "WEB",
"url": "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269"
},
{
"type": "WEB",
"url": "https://www.gnu.org/software/gzip"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6WXM-MPQJ-6JPF
Vulnerability from github – Published: 2025-01-28 17:29 – Updated: 2025-02-18 22:36When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/golang/glog"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-45339"
],
"database_specific": {
"cwe_ids": [
"CWE-377",
"CWE-61"
],
"github_reviewed": true,
"github_reviewed_at": "2025-01-28T17:29:03Z",
"nvd_published_at": "2025-01-28T02:15:28Z",
"severity": "MODERATE"
},
"details": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
"id": "GHSA-6wxm-mpqj-6jpf",
"modified": "2025-02-18T22:36:58Z",
"published": "2025-01-28T17:29:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45339"
},
{
"type": "WEB",
"url": "https://github.com/golang/glog/pull/74"
},
{
"type": "WEB",
"url": "https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2"
},
{
"type": "PACKAGE",
"url": "https://github.com/golang/glog"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00019.html"
},
{
"type": "WEB",
"url": "https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2025-3372"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Insecure Temporary File usage in github.com/golang/glog"
}
GHSA-6XP6-FMC8-PMMR
Vulnerability from github – Published: 2022-03-18 17:50 – Updated: 2022-03-18 17:50A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this directory. The highest threat from this vulnerability is to data confidentiality and integrity.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-20202"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-17T21:01:15Z",
"nvd_published_at": "2021-05-12T15:15:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this directory. The highest threat from this vulnerability is to data confidentiality and integrity.",
"id": "GHSA-6xp6-fmc8-pmmr",
"modified": "2022-03-18T17:50:45Z",
"published": "2022-03-18T17:50:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-7gf3-89f6-823j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20202"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1922128"
},
{
"type": "WEB",
"url": "https://issues.redhat.com/browse/KEYCLOAK-17000"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Temporary Directory Hijacking Vulnerability in Keycloak"
}
GHSA-772J-XVF9-QPF5
Vulnerability from github – Published: 2022-08-24 00:00 – Updated: 2024-11-26 16:10A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible-runner"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-3702"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-377"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-01T22:17:50Z",
"nvd_published_at": "2022-08-23T16:15:00Z",
"severity": "MODERATE"
},
"details": "A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner\u0027s private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.",
"id": "GHSA-772j-xvf9-qpf5",
"modified": "2024-11-26T16:10:26Z",
"published": "2022-08-24T00:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3702"
},
{
"type": "PACKAGE",
"url": "https://github.com/ansible/ansible-runner/pull/742"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible-runner/pull/742/commits"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible-runner/commit/93e95a3df9021a38010386d07df121392d249253"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2021-3702"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1977965"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/ansible-runner/PYSEC-2022-43068.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "ansible-runner vulnerable to Race Condition"
}
GHSA-77G3-3J5W-64W4
Vulnerability from github – Published: 2021-04-07 20:36 – Updated: 2024-09-06 20:16A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0a1"
},
{
"fixed": "2.7.17"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.0a1"
},
{
"fixed": "2.8.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"events": [
{
"introduced": "2.9.0a1"
},
{
"fixed": "2.9.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-10685"
],
"database_specific": {
"cwe_ids": [
"CWE-377",
"CWE-459",
"CWE-668"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-05T14:11:30Z",
"nvd_published_at": "2020-05-11T14:15:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.",
"id": "GHSA-77g3-3j5w-64w4",
"modified": "2024-09-06T20:16:43Z",
"published": "2021-04-07T20:36:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10685"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/pull/68433"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/4e1fe80e681fa466626e9dea53efe6b0253ea1b2"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/51d2514753544a9d58cd7524e27e696b2c944fb5"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/e1273b6faf036ed84e4f4edee85b888a4e256aee"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10685"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-77g3-3j5w-64w4"
},
{
"type": "PACKAGE",
"url": "https://github.com/ansible/ansible"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-1.yaml"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202006-11"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4950"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible"
}
GHSA-7MCW-XMX3-7P8M
Vulnerability from github – Published: 2023-06-13 18:30 – Updated: 2023-06-21 17:18Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "cn.hutool:hutool-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.8.19"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-33695"
],
"database_specific": {
"cwe_ids": [
"CWE-377",
"CWE-732"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-14T16:38:27Z",
"nvd_published_at": "2023-06-13T16:15:13Z",
"severity": "HIGH"
},
"details": "Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the `File.createTempFile()` function at `/core/io/FileUtil.java`.",
"id": "GHSA-7mcw-xmx3-7p8m",
"modified": "2023-06-21T17:18:42Z",
"published": "2023-06-13T18:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33695"
},
{
"type": "WEB",
"url": "https://github.com/dromara/hutool/issues/3103"
},
{
"type": "WEB",
"url": "https://github.com/dromara/hutool/commit/c33550f703f5d1d7dd71ad2992d79a5e5532ce2c"
},
{
"type": "PACKAGE",
"url": "https://github.com/dromara/hutool"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Insecure Temporary File in HuTool"
}
GHSA-867Q-77CC-98MV
Vulnerability from github – Published: 2021-04-29 21:51 – Updated: 2021-05-10 19:29Impact
Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. This vulnerability only impacts unix-like systems where the local system temporary directory is shared between all users. This vulnerability does not impact Windows or modern versions of MacOS.
OpenAPI Generator Maven plug-in creates insecure temporary files during the code generation process. It creates insecure temporary files to store the OpenAPI specification files provided by the users and these temporary files can be read by any users in the system.
The impact of this vulnerability is information disclosure of the contents of the specification file to other local users.
Patches
The issue has been patched with Files.createTempFile and released in the v5.1.0 stable version.
For more information
If you have any questions or comments about this advisory: * Open an issue in OpenAPI Generator Github repo * Email us at security@openapitools.org
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.openapitools:openapi-generator-maven-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21429"
],
"database_specific": {
"cwe_ids": [
"CWE-377",
"CWE-378",
"CWE-379",
"CWE-552"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-27T19:58:51Z",
"nvd_published_at": "2021-04-27T20:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nUsing `File.createTempFile` in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. This vulnerability only impacts unix-like systems where the local system temporary directory is shared between all users. This vulnerability does not impact Windows or modern versions of MacOS.\n\nOpenAPI Generator Maven plug-in creates insecure temporary files during the code generation process. It creates insecure temporary files to store the OpenAPI specification files provided by the users and these temporary files can be read by any users in the system.\n\nThe impact of this vulnerability is information disclosure of the contents of the specification file to other local users.\n\n### Patches\nThe issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [OpenAPI Generator Github repo](https://github.com/openAPITools/openapi-generator/)\n* Email us at [security@openapitools.org](mailto:security@openapitools.org)",
"id": "GHSA-867q-77cc-98mv",
"modified": "2021-05-10T19:29:52Z",
"published": "2021-04-29T21:51:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-867q-77cc-98mv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21429"
},
{
"type": "WEB",
"url": "https://github.com/OpenAPITools/openapi-generator/pull/8795"
},
{
"type": "WEB",
"url": "https://github.com/OpenAPITools/openapi-generator/blob/06ad7a51eff04393203cfa715e54e1fb59d984fe/modules/openapi-generator-maven-plugin/src/main/java/org/openapitools/codegen/plugin/CodeGenMojo.java#L782-L799"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin"
}
No mitigation information available for this CWE.
CAPEC-149: Explore for Predictable Temporary File Names
An attacker explores a target to identify the names and locations of predictable temporary files for the purpose of launching further attacks against the target. This involves analyzing naming conventions and storage locations of the temporary files created by a target application. If an attacker can predict the names of temporary files they can use this information to mount other attacks, such as information gathering and symlink attacks.
CAPEC-155: Screen Temporary Files for Sensitive Information
An adversary exploits the temporary, insecure storage of information by monitoring the content of files used to store temp data during an application's routine execution flow. Many applications use temporary files to accelerate processing or to provide records of state across multiple executions of the application. Sometimes, however, these temporary files may end up storing sensitive information. By screening an application's temporary files, an adversary might be able to discover such sensitive information. For example, web browsers often cache content to accelerate subsequent lookups. If the content contains sensitive information then the adversary could recover this from the web cache.