5.5
CVE-2022-24913
- EPSS 0.07%
- Veröffentlicht 12.01.2023 05:15:11
- Zuletzt bearbeitet 08.04.2025 18:15:43
- Quelle report@snyk.io
- CVE-Watchlists
- Unerledigt
LoginVersions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Java-merge-sort Project ≫ Java-merge-sort Version < 1.1.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.07% | 0.211 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.5 | 1.8 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
| report@snyk.io | 5.5 | 1.8 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
CWE-377 Insecure Temporary File
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
CWE-668 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.