CVE-2021-28168CWE-378CWE-379
Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability
Medium · published April 22, 2021
What it is
Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.
The record
Technical detail
- CVSS v3.1
- 6.2 · MEDIUM
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00869 · 58.4th percentile
- Weaknesses
- CWE-378 · Creation of Temporary File With Insecure Permissions; CWE-379 · Creation of Temporary File in Directory with Insecure Permissions
- Published
- 2021-04-22T17:35Z
EPSS history
Timeline