CVE-2024-23454CWE-378

Apache Hadoop: Temporary File Local Information Disclosure

Medium · published September 25, 2024

CVSS v3.1
6.2
EPSS
0%
Percentile
33.9
In the wild
Unconfirmed
What it is

Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content.

This is because, on unix-like systems, the system temporary directory is

shared between all local users. As such, files written in this directory,

without setting the correct posix permissions explicitly, may be viewable

by all other local users.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00407 · 33.9th percentile
Weakness
CWE-378 · Creation of Temporary File With Insecure Permissions
Published
2024-09-25T07:45Z
EPSS history
Timeline
  • 25 SEP 07:45Z
    Apache Hadoop: Temporary File Local Information Disclosure
    cvelistv5