CVEvulnerability

CVE-2020-27216

7.0 HIGH Published 2020-10-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-10-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.0 HIGH — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-378, CWE-379

Description

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

Affected configurations

• eclipse jetty (>= 1.0 < 9.3.29) • eclipse jetty (>= 9.4.0 <= 9.4.32) • eclipse jetty 10.0.0 • eclipse jetty 11.0.0 • netapp snap creator framework • netapp snapcenter • netapp vasa provider (>= 7.2) • netapp virtual storage console (>= 7.2) • netapp storage replication adapter (>= 7.2) • oracle communications application session controller 3.9m0p2 • oracle communications converged application server - service controller 6.2 • oracle communications element manager (>= 8.2.1 <= 8.2.2.1) • oracle communications offline mediation controller 12.0.0.3.0 • oracle communications pricing design center 12.0.0.3.0 • oracle communications services gatekeeper 7.0 • oracle flexcube core banking (>= 11.5.0 <= 11.9.0) • oracle flexcube private banking 12.0.0 • oracle flexcube private banking 12.1.0 • oracle jd edwards enterpriseone tools (< 9.2.6.0) • oracle siebel core - automation (<= 21.5) • apache beam 2.21.0 • apache beam 2.22.0 • apache beam 2.23.0 • apache beam 2.24.0 • apache beam 2.25.0 • debian debian linux 9.0 • debian debian linux 10.0

Related

Weakness · CWE (2)

  • CWE-378 Creation of Temporary File With Insecure Permissions weakness
  • CWE-379 Creation of Temporary File in Directory with Insecure Permissions weakness

References