CVE-2022-24913
Assigner: snyk
Published: 2023-01-12T05:00:01.920Z
State: PUBLISHED
metrics: cvssV3_1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
credits: value: Jonathan Leitschuh
problemTypes: descriptions: cweId: CWE-377
description: Insecure Temporary File
descriptions: value: Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.
affected: product: com.fasterxml.util:java-merge-sort
versions: version: 0
lessThan: 1.1.0
status: affected
versionType: semver
vendor: n/a