CVE-2021-28168: eclipse jersey

Vulnerability summary

CVE-2021-28168 is a medium (CVSS 6.2) vulnerability in eclipse jersey. EPSS estimates a 0.87% chance of exploitation in the next 30 days, higher than 58% of scored vulnerabilities.

Timeline

1. 22-04-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.

• CWE-378Creation of Temporary File With Insecure PermissionsOpening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
• CWE-379Creation of Temporary File in Directory with Insecure PermissionsThe product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
• CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.