SB2021020813 - Information disclosure in Netty

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021020813

SB2021020813 - Information disclosure in Netty

Published: February 8, 2021 Updated: April 1, 2021

Security Bulletin ID SB2021020813
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Cleartext storage of sensitive information (CVE-ID: CVE-2021-21290)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to insecure usage of temporary files in AbstractDiskHttpData method in Netty. The application stores sensitive information in temporary file that has insecure permissions. A local user can view application's temporary file and gain access to potentially sensitive data.

Remediation

Install update from vendor's website.

References