Information Disclosure

2023-11-2705:16:41

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

storm-core

vulnerability

information disclosure

insecure permissions

file creation

unix-like systems

sensitive information

attacker

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.7

Confidence

High

EPSS

Percentile

5.1%

JSON

storm-core is vulnerable to Information Disclosure. The vulnerability exists because the createExtraPropertiesFile function in TopologySpoutLag.java creates a file with a predefined name (easily identifiable) and, by default, will create this file with insecure permissions (-rw-r--r--) on Unix-like systems. This allows an attacker to read sensitive information.