Skip to main content

Exposure of Resource to Wrong Sphere

CVE-2022-24913

Medium
5.5/10

Summary

Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the "provide()" function in "StdTempFileProvider.java", which uses the permissive "File.createTempFile()" function, exposing temporary file contents.

  • LOW
  • LOCAL
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-668 - Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

References

Advisory Timeline

  • Published