GitHub Advisoryadvisory · Maven

GHSA-5mg8-w23w-74h3 Information Disclosure in Guava

LOW Published 2021-03-25 Modified 2026-02-23 Official page ↗
Aliases
CVE-2020-8908
Ecosystem
Maven
Packages
com.google.guava:guava
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-173, CWE-200, CWE-378, CWE-732
Reviewed
2021-03-25

Affected packages

• Maven com.google.guava:guava: < 32.0.0-android → fixed in 32.0.0-android

Description

A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava `com.google.common.io.Files.createTempDir()`. The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.

Related

Alias · CVE (1)

  • CVE-2020-8908 A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially… vulnerability

Weakness · CWE (4)

  • CWE-173 Improper Handling of Alternate Encoding weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-378 Creation of Temporary File With Insecure Permissions weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References