#VU51835 Cleartext storage of sensitive information in Netty - CVE-2021-21290

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU51835

#VU51835 Cleartext storage of sensitive information in Netty - CVE-2021-21290

Published: April 1, 2021 / Updated: February 11, 2025


Vulnerability identifier: #VU51835
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2021-21290
CWE-ID: CWE-312
Exploitation vector: Local access
Exploit availability: No public exploit available
Vulnerable software:
Netty
Software vendor:
Netty project

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to insecure usage of temporary files in AbstractDiskHttpData method in Netty. The application stores sensitive information in temporary file that has insecure permissions. A local user can view application's temporary file and gain access to potentially sensitive data.

Remediation

Install updates from vendor's website.

External links