Lucene search

VulDBCVELIST:CVE-2018-25068

HistoryJan 06, 2023 - 8:37 p.m.

CVE-2018-25068 devent globalpom-utils FileResourceManagerProvider.java createTmpDir temp file

2023-01-0620:37:32

CWE-377

VulDB

www.cve.org

vulnerability

fileresourcemanagerprovider

createtmpdir

globalpom-utils

insecure temporary file

remotely exploitable

version 4.5.0

patch 77a820bac2f68e662ce261ecb050c643bd7ee560

vdb-217570

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

9.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.4%

JSON

A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical. This vulnerability affects the function createTmpDir of the file globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java. The manipulation leads to insecure temporary file. The attack can be initiated remotely. Upgrading to version 4.5.1 is able to address this issue. The patch is identified as 77a820bac2f68e662ce261ecb050c643bd7ee560. It is recommended to upgrade the affected component. VDB-217570 is the identifier assigned to this vulnerability.

CNA Affected

[
  {
    "vendor": "devent",
    "product": "globalpom-utils",
    "versions": [
      {
        "version": "4.0",
        "status": "affected"
      },
      {
        "version": "4.1",
        "status": "affected"
      },
      {
        "version": "4.2",
        "status": "affected"
      },
      {
        "version": "4.3",
        "status": "affected"
      },
      {
        "version": "4.4",
        "status": "affected"
      },
      {
        "version": "4.5",
        "status": "affected"
      }
    ]
  }
]

References

github.com/devent/globalpom-utils/commit/77a820bac2f68e662ce261ecb050c643bd7ee560

github.com/devent/globalpom-utils/releases/tag/globalpomutils-4.5.1

vuldb.com/?ctiid.217570

vuldb.com/?id.217570

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

9.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.4%

JSON

Related for CVELIST:CVE-2018-25068