CVE-2020-8908

Aliases:GHSA-5mg8-w23w-74h3
Advisory lineage Upstream: 0 Downstream: 11
Modified
Published: 10 Dec 2020, 22:10
Last modified:04 Aug 2024, 10:12

Vulnerability Summary

Overall Risk (default)
low
23/100
CVSS Score
3.3 LOW
v3.1 (cve.org)
EPSS Score
0.07% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

10 Dec 2020, 22:10
Published
Vulnerability first disclosed
04 Aug 2024, 10:12
Last Modified
Vulnerability information updated

Description

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

CVSS Metrics

  • v3.1•LOW•Score: 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  • v2.0•LOW•Score: 2.1AV:L/AC:L/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.07%• Percentile: 22%

Techniques & Countermeasures

  • CWE-378•Creation of Temporary File With Insecure Permissions

    Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.

  • CWE-732•Incorrect Permission Assignment for Critical Resource

    The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Affected Systems

  • google llc•guava

    ≥ 1.0, < 32.0

  • google•guava

    < 32.0.0

  • com.google.guava•guava

    < 32.0.0-android

  • netapp•active_iq_unified_manager

    na

  • oracle•commerce_guided_search

    11.3.2

  • oracle•communications_cloud_native_core_network_repository_function

    1.14.0

  • oracle•communications_cloud_native_core_network_slice_selection_function

    1.2.1

  • oracle•communications_pricing_design_center

    12.0.0.4.0 | 12.0.0.5.0

  • oracle•data_integrator

    12.2.1.3.0 | 12.2.1.4.0

  • oracle•nosql_database

    < 20.3

  • oracle•peoplesoft_enterprise_peopletools

    8.57 | 8.58 | 8.59

  • oracle•primavera_unifier

    ≥ 17.7, ≤ 17.12 | 18.8 | 19.12 | 20.12 | 21.12

  • oracle•retail_customer_management_and_segmentation_foundation

    ≥ 16.0, ≤ 19.0

  • Unknown•WebLogic Server

    14.1.1.0.0

  • quarkus•quarkus

    < 1.11.4

References (83)