CVE-2021-28168

eclipse jersey, oracle communications cloud native core policy, oracle communications cloud native core unified data repository

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-28168

Katalog CVE

CVSS 5.5 · Medium EPSS 0,87%

Kerentanan Creation of Temporary File With Insecure Permissions pada eclipse jersey, oracle communications cloud native core policy +1 lainnya. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.

Rincian

Terbit di NVD
22 April 2021
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-378: Creation of Temporary File With Insecure Permissions
CWE-379: Creation of Temporary File in Directory with Insecure Permissions
CWE-668: Exposure of Resource to Wrong Sphere
EPSS (30 hari)
0,87% peluang dieksploitasi; lebih tinggi dari 57,7% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
eclipse jersey Versi 2.28 hingga sebelum 2.34
eclipse jersey Versi 3.0.0 hingga sebelum 3.0.2
oracle communications cloud native core policy Versi 1.15.0
oracle communications cloud native core unified data repository Versi 1.15.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.