CVE-2022-24913

2023-01-1205:15:11

CWE-377

CWE-668

[email protected]

web.nvd.nist.gov

cve-2022-24913

nvd

package vulnerability

insecure temporary file

stdtempfileprovider

java-merge-sort

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.3%

JSON

Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.

Affected configurations

NVD

Node

java-merge-sort_projectjava-merge-sortRange<1.1.0

CPENameOperatorVersion
java-merge-sort_project:java-merge-sortjava-merge-sort project java-merge-sortlt1.1.0

CPE	Name	Operator	Version
java-merge-sort_project:java-merge-sort	java-merge-sort project java-merge-sort	lt	1.1.0

CNA Affected

[
  {
    "product": "com.fasterxml.util:java-merge-sort",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.1.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]