CVE-2021-21429

Katalog CVE

CVSS 3.3 · Low EPSS 0,30%

Kerentanan Files or Directories Accessible to External Parties pada openapi-generator openapi generator. Skor CVSS 3.1 3.3 (Low) menurut NVD.

Deskripsi (NVD)

OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using `File.createTempFile` in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. OpenAPI Generator maven plug-in creates insecure temporary files during the process. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.

Rincian

Terbit di NVD

27 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OpenAPITools/openapi-generator/pull/8795 patch · advisory pihak ketiga
• https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-867q-77cc-98mv patch · advisory pihak ketiga