Strix
26.1K

CVE-2020-8908

LOWCVSS 3.3/10EPSS 0.96%

Last modified

CVE-2020-8908 is a low-severity vulnerability rated 3.3/10 on the CVSS scale. A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). EPSS estimates a 0.96% chance of exploitation in the next 30 days.

Description

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Metrics

CVSS 3.1
3.3/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS Probability
0.96%

57.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
GoogleGuava< 32.0.0
QuarkusQuarkus< 1.11.4
OracleCommerce Guided Search11.3.2
OracleCommunications Cloud Native Core Network Slice Selection Function1.2.1
OracleCommunications Pricing Design Center12.0.0.4.0
OracleCommunications Pricing Design Center12.0.0.5.0
OracleData Integrator12.2.1.3.0
OracleData Integrator12.2.1.4.0
OracleNosql Database< 20.3
OraclePeoplesoft Enterprise Peopletools8.57
OraclePeoplesoft Enterprise Peopletools8.58
OraclePeoplesoft Enterprise Peopletools8.59
OracleRetail Customer Management And Segmentation Foundation>= 16.0, <= 19.0
OracleWeblogic Server14.1.1.0.0
OracleCommunications Cloud Native Core Network Repository Function1.14.0
OraclePrimavera Unifier>= 17.7, <= 17.12
OraclePrimavera Unifier18.8
OraclePrimavera Unifier19.12
OraclePrimavera Unifier20.12
OraclePrimavera Unifier21.12
NetappActive Iq Unified ManagerAll versions

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-8908?
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
How severe is CVE-2020-8908?
CVE-2020-8908 has a CVSS score of 3.3/10 (LOW severity). The EPSS model estimates a 0.96% probability of exploitation in the next 30 days.
How do I fix CVE-2020-8908?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-8908?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST