CVE-2018-25068

Katalog CVE

CVSS 9.8 · Critical EPSS 0,81%

Kerentanan Insecure Temporary File pada globalpom-utils project globalpom-utils. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical. This vulnerability affects the function createTmpDir of the file globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java. The manipulation leads to insecure temporary file. The attack can be initiated remotely. Upgrading to version 4.5.1 is able to address this issue. The patch is identified as 77a820bac2f68e662ce261ecb050c643bd7ee560. It is recommended to upgrade the affected component. VDB-217570 is the identifier assigned to this vulnerability.

Rincian

Terbit di NVD

6 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-377: Insecure Temporary File
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

0,81% peluang dieksploitasi; lebih tinggi dari 55,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/devent/globalpom-utils/commit/77a820bac2f68e662ce261ecb050c643bd7ee560 patch
• https://vuldb.com/?ctiid.217570 advisory pihak ketiga
• https://vuldb.com/?id.217570 advisory pihak ketiga
• https://github.com/devent/globalpom-utils/releases/tag/globalpomutils-4.5.1 release notes