Lucene search

K
nvd[email protected]NVD:CVE-2023-2976
HistoryJun 14, 2023 - 6:15 p.m.

CVE-2023-2976

2023-06-1418:15:09
CWE-552
web.nvd.nist.gov
11
google guava
java
filebackedoutputstream
unix systems
android ice cream sandwich
temporary directory
security vulnerability
access control
version 32.0.1
windows functionality

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

6.4

Confidence

High

EPSS

0

Percentile

15.5%

Use of Javaโ€™s default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.

Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

Affected configurations

Nvd
Node
googleguavaRange<32.0.0
VendorProductVersionCPE
googleguava*cpe:2.3:a:google:guava:*:*:*:*:*:*:*:*

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

6.4

Confidence

High

EPSS

0

Percentile

15.5%