eclipse jetty, netapp snap creator framework, netapp snapcenter +15 lainnya
CVSS 7.0 · High EPSS 4,4%
Kerentanan Creation of Temporary File With Insecure Permissions pada eclipse jetty, netapp snap creator framework +16 lainnya. Skor CVSS 3.1 7.0 (High) menurut NVD.
In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| eclipse | jetty | Versi 1.0 hingga sebelum 9.3.29 |
| eclipse | jetty | Versi 9.4.0 hingga 9.4.32 |
| eclipse | jetty | Versi 10.0.0 alpha1 |
| eclipse | jetty | Versi 10.0.0 beta0 |
| eclipse | jetty | Versi 10.0.0 beta1 |
| eclipse | jetty | Versi 10.0.0 beta2 |
| eclipse | jetty | Versi 11.0.0 alpha1 |
| eclipse | jetty | Versi 11.0.0 beta1 |
| eclipse | jetty | Versi 11.0.0 beta2 |
| netapp | snap creator framework | Semua versi |
| netapp | snapcenter | Semua versi |
| netapp | vasa provider | Versi 7.2 dan sesudahnya |
| netapp | virtual storage console | Versi 7.2 dan sesudahnya |
| netapp | storage replication adapter | Versi 7.2 dan sesudahnya |
| oracle | communications application session controller | Versi 3.9m0p2 |
| oracle | communications converged application server - service controller | Versi 6.2 |
| oracle | communications element manager | Versi 8.2.1 hingga 8.2.2.1 |
| oracle | communications offline mediation controller | Versi 12.0.0.3.0 |
| oracle | communications pricing design center | Versi 12.0.0.3.0 |
| oracle | communications services gatekeeper | Versi 7.0 |
| oracle | flexcube core banking | Versi 11.5.0 hingga 11.9.0 |
| oracle | flexcube private banking | Versi 12.0.0 |
| oracle | flexcube private banking | Versi 12.1.0 |
| oracle | jd edwards enterpriseone tools | Semua versi sebelum 9.2.6.0 |
| oracle | siebel core - automation | Semua versi hingga 21.5 |
| apache | beam | Versi 2.21.0 |
| apache | beam | Versi 2.22.0 |
| apache | beam | Versi 2.23.0 |
| apache | beam | Versi 2.24.0 |
| apache | beam | Versi 2.25.0 |
| debian | debian linux | Versi 9.0 |
| debian | debian linux | Versi 10.0 |