CVEvulnerability

CVE-2020-8908

3.3 LOW Published 2020-12-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-12-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.3 LOW — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
3.3 LOW — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-378, CWE-732

Description

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Affected configurations

• google guava (< 32.0.0) • quarkus quarkus (< 1.11.4) • oracle commerce guided search 11.3.2 • oracle communications cloud native core network slice selection function 1.2.1 • oracle communications pricing design center 12.0.0.4.0 • oracle communications pricing design center 12.0.0.5.0 • oracle data integrator 12.2.1.3.0 • oracle data integrator 12.2.1.4.0 • oracle nosql database (< 20.3) • oracle peoplesoft enterprise peopletools 8.57 • oracle peoplesoft enterprise peopletools 8.58 • oracle peoplesoft enterprise peopletools 8.59 • oracle retail customer management and segmentation foundation (>= 16.0 <= 19.0) • oracle weblogic server 14.1.1.0.0 • oracle communications cloud native core network repository function 1.14.0 • oracle primavera unifier (>= 17.7 <= 17.12) • oracle primavera unifier 18.8 • oracle primavera unifier 19.12 • oracle primavera unifier 20.12 • oracle primavera unifier 21.12 • netapp active iq unified manager

Related

Weakness · CWE (2)

  • CWE-378 Creation of Temporary File With Insecure Permissions weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References