CVEvulnerability

CVE-2021-28168

5.5 MEDIUM Published 2021-04-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-04-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.2 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-378, CWE-379, CWE-668

Description

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.

Affected configurations

• eclipse jersey (>= 2.28 < 2.34) • eclipse jersey (>= 3.0.0 < 3.0.2) • oracle communications cloud native core policy 1.15.0 • oracle communications cloud native core unified data repository 1.15.0

Related

Weakness · CWE (3)

  • CWE-378 Creation of Temporary File With Insecure Permissions weakness
  • CWE-379 Creation of Temporary File in Directory with Insecure Permissions weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References