5.5

CVE-2023-43123: apache software foundation apache storm

CVSS: 5.5v3.1MediumModified
AliasesGHSA-85p4-q357-72h9
Published 23-11-2023Last modified 13-02-2025
Open JSON

Vulnerability summary

CVE-2023-43123 is a medium (CVSS 5.5) vulnerability in apache software foundation apache storm. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.3% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.35%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 23-11-2023
    PublishedVulnerability first disclosed.
  2. 13-02-2025
    Last modifiedVulnerability information updated.

Description

On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method File.createTempFile on unix-like systems creates a file with predefined name (so easily identifiable) and by default will create this file with the permissions -rw-r--r--. Thus, if sensitive information is written to this file, other local users can read this information. File.createTempFile(String, String) will create a temporary file in the system temporary directory if the 'java.io.tmpdir' system property is not explicitly set. This affects the class  https://github.com/apache/storm/blob/master/storm-core/src/jvm/org/apache/storm/utils/TopologySpoutLag.java#L99  and was introduced by  https://issues.apache.org/jira/browse/STORM-3123 In practice, this has a very limited impact as this class is used only if ui.disable.spout.lag.monitoring is set to false, but its value is true by default. Moreover, the temporary file gets deleted soon after its creation. The solution is to use  Files.createTempFile https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/nio/file/Files.html#createTempFile(java.lang.String,java.lang.String,java.nio.file.attribute.FileAttribute...)  instead. We recommend that all users upgrade to the latest version of Apache Storm.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.35%

Chance of exploitation in the next 30 days

Percentile

27%

Versus all other CVEs

30-day change

+0.01 pp

From 0.35% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.35%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Apache1 product
Apache software foundation1 product
Org.apache.storm1 product
  • storm-core≥ 2.0.0, < 2.6.0

3 vendors · 3 products

References

8 links