Lucene search

GitHub_MCVE-2021-21428

HistoryMay 10, 2021 - 7:15 p.m.

CVE-2021-21428

2021-05-1019:15:08

CWE-269

CWE-668

GitHub_M

web.nvd.nist.gov

openapi

generator

insecure temporary folder

issue

v5.1.0

security

patch

vulnerability

java

api client libraries

sdk generation

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

9.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

17.8%

JSON

Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system. The issue has been patched with Files.createTempFile and released in the v5.1.0 stable version.

Affected configurations

Nvd

Vulners

Node

openapi-generatoropenapi_generatorRange<5.1.0

VendorProductVersionCPE
openapi-generatoropenapi_generator*cpe:2.3:a:openapi-generator:openapi_generator:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openapi-generator	openapi_generator	*	cpe:2.3:a:openapi-generator:openapi_generator::::::::

CNA Affected

[
  {
    "product": "openapi-generator",
    "vendor": "OpenAPITools",
    "versions": [
      {
        "status": "affected",
        "version": "< 5.1.0"
      }
    ]
  }
]

References

github.com/OpenAPITools/openapi-generator/pull/8788

github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-23x4-m842-fmwf

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

9.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

17.8%

JSON

Related for CVE-2021-21428