{"schemaVersion":3,"id":"CVE-2024-23454","aliases":["CGA-6m6v-j5wg-83gr","CGA-9r8j-v2gf-9374","CGA-c399-388w-j24j","CGA-c58c-98r6-4jh5","CGA-f4m9-xpqp-wqx8","CGA-fqc5-crj9-2j9m","CGA-g3w5-g5f4-7q2g","CGA-h6qv-hjr2-32pg","CGA-j9c2-h95w-v877","CGA-q7cx-2wjf-6x5w","CGA-qjwc-g52v-v6gv","CGA-qq7p-f78j-vfq3","CGA-rqcf-8vpc-7c8q","CGA-whg2-g6pg-qq82","CGA-24cc-ffxh-frrw","CGA-2hp9-27w8-j2vf","CGA-3h3w-3mvw-f6jm","CGA-3mm3-5p37-3mhj","CGA-59jq-8qcm-5g88","CGA-5j56-jvpv-vvcr","CGA-5pgj-8jxq-wgqw","CGA-5q22-j84v-3xj9","CGA-65r7-mx2c-j8qg","CGA-74qw-xgr9-cqr4","CGA-79w7-7x5j-pv29","CGA-7px5-9jv9-6jjp","CGA-87rj-wjm7-2xgc","CGA-8mp4-hq87-p65m","CGA-cwrj-h4gj-3cxp","CGA-f4pg-4c62-85v6","CGA-gvhp-p72j-66h2","CGA-h23h-qfc4-9rfg","CGA-hjvr-jv95-22q8","CGA-hjw7-3x2g-4p2q","CGA-hvj8-2wvq-p2f6","CGA-p52m-9v34-v3vw","CGA-pr4v-4vm3-9q4c","CGA-pv78-q4ff-rqjq","GHSA-f5fw-25gw-5m92","CGA-q3r6-qvq8-r63j","CGA-qhxc-9wxf-74c5","CGA-vh4q-8p5c-9f89","CGA-vh52-4384-h4hq","CGA-w2pr-f54f-9j62","CGA-w7f5-j4cg-g434","CGA-wc2r-h59m-27jg","CGA-wcm8-m5cr-c5cc","CGA-wm29-9h23-rmw5","CGA-wpvv-3j84-c474"],"status":"published","duplicateOf":null,"title":null,"description":"Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content.\nThis is because, on unix-like systems, the system temporary directory is\nshared between all local users. As such, files written in this directory,\nwithout setting the correct posix permissions explicitly, may be viewable\nby all other local users.","dates":{"published":"2024-09-25T07:45:43.496Z","modified":"2025-09-05T09:09:36.997Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.2,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":6.4,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":6.4,"impact":6,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Maven","score":2,"severity":"low","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":3.3,"severity":"low","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","exploitability":4.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00407,"percentile":0.33549,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.022999999999999972,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00384},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00407,"percentile":0.33549}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00407,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00407,"percentile":0.33549}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-378","name":"Creation of Temporary File With Insecure Permissions","description":"Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/378.html"}],"affected":[{"vendor":"apache software foundation","product":"apache hadoop","name":"Apache Hadoop","label":"apache hadoop","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 3.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.4.0","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_hadoop"},{"vendor":"apache","product":"hadoop","name":"hadoop","label":"hadoop","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 3.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.4.0","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"apache-hadoop","label":"Apache Hadoop","category":"database"}},"hubHref":"/vendor/apache/hadoop"},{"vendor":"chainguard","product":"apache-nifi","name":"apache-nifi","label":"apache-nifi","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi","purlType":"apk","versions":[{"text":"< 2.0.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-nifi-compat","name":"apache-nifi-compat","label":"apache-nifi-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi-compat","purlType":"apk","versions":[{"text":"< 2.0.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-nifi-toolkit","name":"apache-nifi-toolkit","label":"apache-nifi-toolkit","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi-toolkit","purlType":"apk","versions":[{"text":"< 2.0.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"celeborn-0.5","name":"celeborn-0.5","label":"celeborn-0.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/celeborn-0.5","purlType":"apk","versions":[{"text":"< 0.5.4-r26","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.5.4-r26","eol":null,"hubHref":null},{"vendor":"chainguard","product":"celeborn-0.6","name":"celeborn-0.6","label":"celeborn-0.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/celeborn-0.6","purlType":"apk","versions":[{"text":"< 0.6.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.3-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"druid","name":"druid","label":"druid","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/druid","purlType":"apk","versions":[{"text":"< 37.0.0-r6","noFixRecorded":false,"fixedIn":null},{"text":"< 37.0.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 37.0.0-r6 | < 37.0.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hadoop-client-modules","name":"hadoop-client-modules","label":"hadoop-client-modules","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hadoop-client-modules","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hadoop-fips-3.3.6","name":"hadoop-fips-3.3.6","label":"hadoop-fips-3.3.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hadoop-fips-3.3.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hadoop-fips-3.4.2","name":"hadoop-fips-3.4.2","label":"hadoop-fips-3.4.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hadoop-fips-3.4.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ranger","name":"ranger","label":"ranger","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ranger","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"spark-3.5-scala-2.12","name":"spark-3.5-scala-2.12","label":"spark-3.5-scala-2.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/spark-3.5-scala-2.12","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"spark-3.5-scala-2.13","name":"spark-3.5-scala-2.13","label":"spark-3.5-scala-2.13","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/spark-3.5-scala-2.13","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"spark-fips-3.5-scala-2.12","name":"spark-fips-3.5-scala-2.12","label":"spark-fips-3.5-scala-2.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/spark-fips-3.5-scala-2.12","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"spark-fips-3.5-scala-2.13","name":"spark-fips-3.5-scala-2.13","label":"spark-fips-3.5-scala-2.13","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/spark-fips-3.5-scala-2.13","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi","name":"apache-nifi","label":"apache-nifi","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi","purlType":"apk","versions":[{"text":"< 2.0.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi-compat","name":"apache-nifi-compat","label":"apache-nifi-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi-compat","purlType":"apk","versions":[{"text":"< 2.0.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi-toolkit","name":"apache-nifi-toolkit","label":"apache-nifi-toolkit","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi-toolkit","purlType":"apk","versions":[{"text":"< 2.0.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"celeborn-0.6","name":"celeborn-0.6","label":"celeborn-0.6","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/celeborn-0.6","purlType":"apk","versions":[{"text":"< 0.6.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.3-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"druid","name":"druid","label":"druid","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/druid","purlType":"apk","versions":[{"text":"< 37.0.0-r6","noFixRecorded":false,"fixedIn":null},{"text":"< 37.0.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 37.0.0-r6 | < 37.0.0-r0","eol":null,"hubHref":null},{"vendor":"org.apache.hadoop","product":"hadoop-common","name":"org.apache.hadoop:hadoop-common","label":"hadoop-common","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.hadoop/hadoop-common","purlType":"maven","versions":[{"text":"< 3.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.4.0","eol":null,"hubHref":null}],"affectedCount":22,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://issues.apache.org/jira/browse/HADOOP-19031","label":"issues.apache.org/jira/browse/HADOOP-19031","hostname":"issues.apache.org","tags":["Issue Tracking","REPORT","WEB","Patch","Vendor Advisory"]},{"url":"https://lists.apache.org/thread/xlo7q8kn4tsjvx059r789oz19hzgfkfs","label":"lists.apache.org/thread/xlo7q8kn4tsjvx059r789oz19hzgfkfs","hostname":"lists.apache.org","tags":["Vendor Advisory","Advisory","WEB","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2024/09/25/1","label":"www.openwall.com/lists/oss-security/2024/09/25/1","hostname":"www.openwall.com","tags":["WEB","Mailing List","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241101-0002/","label":"security.netapp.com/advisory/ntap-20241101-0002/","hostname":"security.netapp.com","tags":["Advisory","Third Party Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23454.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23454.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23454","label":"nvd.nist.gov/vuln/detail/CVE-2024-23454","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/apache/hadoop/commit/8c2836402fbb2f619f1fef4ef625a8542e853a64","label":"github.com/apache/hadoop/commit/8c2836402fbb2f619f1fef4ef625a8542e853a64","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/hadoop","label":"github.com/apache/hadoop","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://security.netapp.com/advisory/ntap-20241101-0002","label":"security.netapp.com/advisory/ntap-20241101-0002","hostname":"security.netapp.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-VP79-CC44-7XFG"]},"timeline":[{"kind":"published","date":"2024-09-25T07:45:43.496Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-09-05T09:09:36.997Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T18:17:01.449Z","stale":false,"partial":false}}