CVE-2022-24913

Katalog CVE

CVSS 5.5 · Medium EPSS 0,24%

Kerentanan Insecure Temporary File pada java-merge-sort project java-merge-sort. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.

Rincian

Terbit di NVD

12 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-377: Insecure Temporary File
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 14,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cowtowncoder/java-merge-sort/commit/450fdee70b5f181c2afc5d817f293efa1a543902 patch · advisory pihak ketiga
• https://github.com/cowtowncoder/java-merge-sort/pull/21 patch · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLUTIL-3227926 advisory pihak ketiga