Vulnetix
Try Vulnetix Request Demo
CVE-2020-8908 PUBLISHED

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

EPSS 0.07% · 22.3th percentile

Risk Scores

EPSS Score
0.07%
22.3th percentile

Affected Products

VendorProductVersions
Ubuntu:22.04:LTSguava-libraries29.0-6, 0
AWSconfig
Cloudflareaccess
Ubuntu:20.04:LTSguava-libraries0, 19.0-1
Ubuntu:18.04:LTSguava-libraries19.0-1, 0
Ubuntu:14.04:LTSguava-libraries0, 15.0-2ubuntu1, 14.0.1-1
Ubuntu:16.04:LTSguava-libraries19.0-1, 18.0-4ubuntu1, 0

Timeline

References

Open in Interactive Console →