Insecure Temporary File in JUnit - CVE-2020-15250

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU49330

Insecure Temporary File in JUnit - CVE-2020-15250

Published: October 12, 2020 / Updated: January 7, 2021


Vulnerability identifier: #VU49330
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2020-15250
CWE-ID: CWE-377
Exploitation vector: Local access
Exploit availability: No public exploit available
Affected software:
JUnit
API Manager
Oracle Banking Liquidity Management
API Gateway
Oracle WebLogic Server
TensorFlow
Netcool/OMNIbus
IBM Cloud Pak for Business Automation
IBM Cloud Pak for Security
IBM Cloud Transformation Advisor
IBM Sterling B2B Integrator
Tivoli Composite Application Manager for Transactions
IBM Disconnected Log Collector
JD Edwards EnterpriseOne Tools
Oracle Communications Cloud Native Core Policy
Apache Pulsar
Voice Gateway
junit (Alpine package)
junit4-doc (Ubuntu package)
junit4 (Ubuntu package)
junit
junit-help
Knowledge Catalog Premium Cartridge
IBM Business Automation Manager Open Editions
Business Automation Insights
IBM Security Risk Manager
Cloudera Observability with IBM
Engineering Test Management
MongoDB Enterprise Advanced with IBM
IBM Security Guardium
Ubuntu
openEuler
watsonx.data

Detailed vulnerability description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to the application is using the test rule TemporaryFolder that stores sensitive information in temporary files in the system temporary directory, accessible by other system users. A local user can read temporary files and obtain sensitive information, related to the application.


How to mitigate CVE-2020-15250

Install updates from vendor's website.

Sources