Lucene search

GitHub_MCVE-2021-21430

HistoryMay 10, 2021 - 8:15 p.m.

CVE-2021-21430

2021-05-1020:15:07

CWE-269

CWE-668

GitHub_M

web.nvd.nist.gov

cve-2021

openapi generator

api client libraries

sdk generation

server stubs

documentation

configuration

file.createtempfile

jdk

insecure temporary files

auto-generated code

java

scala

uploading

downloading

binary data

api endpoints

generators

jerse2

okhttp-gson

scala-finch

files.createtempfile

v5.1.0 stable version

nvd

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

6.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

29.1%

JSON

OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. Auto-generated code (Java, Scala) that deals with uploading or downloading binary data through API endpoints will create insecure temporary files during the process. Affected generators: java (jersey2, okhttp-gson (default library)), scala-finch. The issue has been patched with Files.createTempFile and released in the v5.1.0 stable version.

Affected configurations

Nvd

Vulners

Node

openapi-generatoropenapi_generatorRange<5.1.1

VendorProductVersionCPE
openapi-generatoropenapi_generator*cpe:2.3:a:openapi-generator:openapi_generator:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openapi-generator	openapi_generator	*	cpe:2.3:a:openapi-generator:openapi_generator::::::::

CNA Affected

[
  {
    "product": "openapi-generator",
    "vendor": "OpenAPITools",
    "versions": [
      {
        "status": "affected",
        "version": "< 5.1.0"
      }
    ]
  }
]

References

github.com/OpenAPITools/openapi-generator/pull/8787

github.com/OpenAPITools/openapi-generator/pull/8791

github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-cqxr-xf2w-943w

Social References

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

6.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

29.1%

JSON

Related for CVE-2021-21430