Versio.io

CVE-2020-8908

Common vulnerabilities & exposures (CVE)

CVE databaseCVE database blogpostRelease & EoL database
 
Published at: - 11-12-2020 12:15
Last modified: - 10-05-2022 05:21
Total changes: - 24

Description

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Low
Attack complexity
Local
Attack vector
None
Availability
Low
Confidentiality
None
Integrity
Low
Privileges required
Unchanged
Scope
None
User interaction
3.3
Base score
1.8
1.4
Exploitability score
Impact score
 

Verification logic

OR
OR
vendor=google AND product=guava AND versionEndExcluding=30.0
OR
vendor=quarkus AND product=quarkus AND versionEndExcluding=1.11.4
OR
vendor=oracle AND product=peoplesoft_enterprise_peopletools AND version=8.57
vendor=oracle AND product=data_integrator AND version=12.2.1.3.0
vendor=oracle AND product=peoplesoft_enterprise_peopletools AND version=8.58
vendor=oracle AND product=weblogic_server AND version=14.1.1.0.0
vendor=oracle AND product=data_integrator AND version=12.2.1.4.0
vendor=oracle AND product=nosql_database AND versionEndExcluding=20.3
vendor=oracle AND product=commerce_guided_search AND version=11.3.2
vendor=oracle AND product=peoplesoft_enterprise_peopletools AND version=8.59
vendor=oracle AND product=communications_cloud_native_core_network_slice_selection_function AND version=1.2.1
vendor=oracle AND product=retail_customer_management_and_segmentation_foundation AND versionEndIncluding=19.0 AND versionStartIncluding=16.0
vendor=oracle AND product=communications_pricing_design_center AND version=12.0.0.4.0
vendor=oracle AND product=communications_pricing_design_center AND version=12.0.0.5.0
OR
vendor=oracle AND product=primavera_unifier AND version=18.8
vendor=oracle AND product=primavera_unifier AND versionEndIncluding=17.12 AND versionStartIncluding=17.7
vendor=oracle AND product=primavera_unifier AND version=19.12
vendor=oracle AND product=primavera_unifier AND version=20.12
vendor=oracle AND product=communications_cloud_native_core_network_repository_function AND version=1.14.0
vendor=oracle AND product=primavera_unifier AND version=21.12
OR
vendor=netapp AND product=active_iq_unified_manager AND version=- AND target_software=vmware_vsphere
vendor=netapp AND product=active_iq_unified_manager AND version=- AND target_software=linux
vendor=netapp AND product=active_iq_unified_manager AND version=- AND target_software=windows
 

Reference

 


Keywords

NVD

 

CVE-2020-8908

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures

 

We use cookies to ensure that we give you the best experience on our website. Read privacy policies for more information.