description: Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.
problem types: CWE-378: Creation of Temporary File With Insecure Permissions
affected:
{
product: Eclipse Jersey
vendor: The Eclipse Foundation
versions:
lessThan: unspecified, status: affected, version: 2.28, versionType: custom
lessThanOrEqual: 2.33, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 3.0.0, versionType: custom
lessThanOrEqual: 3.0.1, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]