Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-8908

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Published

2020-12-10T23:15:13.973

Last Modified

2024-11-21T05:39:40.053

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 3.3 (LOW)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

3.9

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-378
  • Type: Primary
    CWE-732
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application google guava < 32.0.0 Yes
Application quarkus quarkus < 1.11.4 Yes
Application oracle commerce_guided_search 11.3.2 Yes
Application oracle communications_cloud_native_core_network_slice_selection_function 1.2.1 Yes
Application oracle communications_pricing_design_center 12.0.0.4.0 Yes
Application oracle communications_pricing_design_center 12.0.0.5.0 Yes
Application oracle data_integrator 12.2.1.3.0 Yes
Application oracle data_integrator 12.2.1.4.0 Yes
Application oracle nosql_database < 20.3 Yes
Application oracle peoplesoft_enterprise_peopletools 8.57 Yes
Application oracle peoplesoft_enterprise_peopletools 8.58 Yes
Application oracle peoplesoft_enterprise_peopletools 8.59 Yes
Application oracle retail_customer_management_and_segmentation_foundation ≤ 19.0 Yes
Application oracle weblogic_server 14.1.1.0.0 Yes
Application oracle communications_cloud_native_core_network_repository_function 1.14.0 Yes
Application oracle primavera_unifier ≤ 17.12 Yes
Application oracle primavera_unifier 18.8 Yes
Application oracle primavera_unifier 19.12 Yes
Application oracle primavera_unifier 20.12 Yes
Application oracle primavera_unifier 21.12 Yes
Application netapp active_iq_unified_manager - Yes
Application netapp active_iq_unified_manager - Yes
Application netapp active_iq_unified_manager - Yes
References