Düşük CVSS 3.3 PoC var

CVE-2020-8908: Guava: güvenlik açığı

Yayın: 11 Aralık 2020 02:15 · Güncelleme: 6 Kasım 2026 09:46

Açıklama (NVD)

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Özet bilgiler

Ürün: Google Guava
CVSS v3.1: 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: %0,92 (yüzdelik 61)
CWE: CWE-378
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
google-guava	—	—	32.0.0
quarkus-quarkus	—	—	1.11.4
oracle-commerce-guided-search	11.3.2	11.3.2	—
oracle-communications-cloud-native-core-network-slice-selection-function	1.2.1	1.2.1	—
oracle-communications-pricing-design-center	12.0.0.4.0	12.0.0.4.0	—
oracle-communications-pricing-design-center	12.0.0.5.0	12.0.0.5.0	—
oracle-data-integrator	12.2.1.3.0	12.2.1.3.0	—
oracle-data-integrator	12.2.1.4.0	12.2.1.4.0	—
oracle-nosql-database	—	—	20.3
oracle-peoplesoft-enterprise-peopletools	8.57	8.57	—
oracle-peoplesoft-enterprise-peopletools	8.58	8.58	—
oracle-peoplesoft-enterprise-peopletools	8.59	8.59	—
oracle-retail-customer-management-and-segmentation-foundation	16.0	19.0	—
oracle-weblogic-server	14.1.1.0.0	14.1.1.0.0	—
oracle-communications-cloud-native-core-network-repository-function	1.14.0	1.14.0	—
oracle-primavera-unifier	17.7	17.12	—
oracle-primavera-unifier	18.8	18.8	—
oracle-primavera-unifier	19.12	19.12	—
oracle-primavera-unifier	20.12	20.12	—
oracle-primavera-unifier	21.12	21.12	—
netapp-active-iq-unified-manager	—	—	—
netapp-active-iq-unified-manager	—	—	—
netapp-active-iq-unified-manager	—	—	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları