CVE-2018-25068 (Java, published 2023-01-06T21:15Z)
Description: value: A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical. This vulnerability affects the function createTmpDir of the file globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java. The manipulation leads to insecure temporary file. The attack can be initiated remotely. Upgrading to version 4.5.1 is able to address this issue. The patch is identified as 77a820bac2f68e662ce261ecb050c643bd7ee560. It is recommended to upgrade the affected component. VDB-217570 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/devent/globalpom-utils
Files changed:
globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java
Commit message: Feature #4100 Fix critical Vulnerability

"File.createTempFile" should not be used to create a directory


Vulnerable code:
/*
 * Copyright 2016 Erwin Müller <erwin.mueller@deventm.org>
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
 * 
 * 
 * 
public class FileResourceManagerProvider implements
		Provider<FileResourceManager> {
	@Inject
	private FileResourceManagerProviderLogger log;
	private String storeDir;
	private boolean debug;
	/**
	 * Sets debug enabled for the file resource manager.
	 * 
	 * @param debug
	 *            set to {@code true} to enable debug before creating the
	 *            manager.
	 */
	public void setDebug(boolean debug) {
		this.debug = debug;
	}
	/**
	 * Sets the store directory path for the file resource manager.
	 * 
	 * @param path
	 *            the store directory {@link File} path.
	 */
	public void setStoreDir(File path) {
		setStoreDir(path.getAbsolutePath());
	}
	/**
	 * Sets the store directory path for the file resource manager.
	 * 
	 * @param path
	 *            the store directory path.
	 */
	public void setStoreDir(String path) {
		this.storeDir = path;
	}
	@Override
	public FileResourceManager get() {
		String workDir = createTmpDir();
		boolean urlEncodePath = false;
		final ByteArrayOutputStream stream = new ByteArrayOutputStream(1024);
		PrintWriter printWriter = new PrintWriter(stream) {
			@Override
			public void flush() {
				super.flush();
				log.logFileResourceMessage(stream.toString());
			}
		};
		LoggerFacade logger = new PrintWriterLogger(printWriter, "", debug);
		return new FileResourceManager(storeDir, workDir, urlEncodePath, logger);
	}
	private String createTmpDir() {
		try {
			File tmp = File.createTempFile("fileresourcemanager", null);
			tmp.delete();
			tmp.mkdir();
			String workDir = tmp.getAbsolutePath();
			return workDir;
		} catch (IOException e) {
			throw log.errorCreateWorkDir(e);
		}
	}

Fixed code:
 *
 *
import java.nio.file.Files;
 *
public class FileResourceManagerProvider implements Provider<FileResourceManager> {
    @Inject
    private FileResourceManagerProviderLogger log;
    private String storeDir;
    private boolean debug;
    /**
     * Sets debug enabled for the file resource manager.
     *
     * @param debug set to {@code true} to enable debug before creating the manager.
     */
    public void setDebug(boolean debug) {
        this.debug = debug;
    }
    /**
     * Sets the store directory path for the file resource manager.
     *
     * @param path the store directory {@link File} path.
     */
    public void setStoreDir(File path) {
        setStoreDir(path.getAbsolutePath());
    }
    /**
     * Sets the store directory path for the file resource manager.
     *
     * @param path the store directory path.
     */
    public void setStoreDir(String path) {
        this.storeDir = path;
    }
    @Override
    public FileResourceManager get() {
        String workDir = createTmpDir();
        boolean urlEncodePath = false;
        final ByteArrayOutputStream stream = new ByteArrayOutputStream(1024);
        PrintWriter printWriter = new PrintWriter(stream) {
            @Override
            public void flush() {
                super.flush();
                log.logFileResourceMessage(stream.toString());
            }
        };
        LoggerFacade logger = new PrintWriterLogger(printWriter, "", debug);
        return new FileResourceManager(storeDir, workDir, urlEncodePath, logger);
    }
    private String createTmpDir() {
        try {
            File tmp = Files.createTempDirectory("fileresourcemanager").toFile();
            String workDir = tmp.getAbsolutePath();
            return workDir;
        } catch (IOException e) {
            throw log.errorCreateWorkDir(e);
        }
    }