CVE-2022-21126 Creation of Temporary File in Directory with Insecure Permissions

2022-11-2900:00:00

snyk

www.cve.org

com.github.samtools:htsjdk

cve-2022-21126

insecure permissions

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

0.0005 Low

EPSS

Percentile

17.9%

JSON

The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "com.github.samtools:htsjdk",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "3.0.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]