{"cve":"CVE-2021-23331","nvd":{"published":"2021-02-03T18:15:16.430","modified":"2026-06-17T03:38:34.270","status":"Modified","description":"This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workaround fix for this issue is to set the system property java.io.tmpdir to a safe directory as remediation. Note: This version of the SDK is end of life and no longer maintained, please upgrade to the latest version.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":3.3},"cwes":[],"references":["https://github.com/square/connect-java-sdk/blob/master/src/main/java/com/squareup/connect/ApiClient.java%23L613","https://snyk.io/vuln/SNYK-JAVA-COMSQUAREUP-1065988","https://github.com/square/connect-java-sdk/blob/master/src/main/java/com/squareup/connect/ApiClient.java%23L613","https://snyk.io/vuln/SNYK-JAVA-COMSQUAREUP-1065988"],"products":["squareup:connect_java_software_development_kit"],"source":"nvd","synced_at":"2026-10-19T21:14:10.479542811+00:00"},"epss":{"cve":"CVE-2021-23331","score":0.00346,"percentile":0.28163,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-q4hm-fwc9-hmv6","url":"https://osv.dev/vulnerability/GHSA-q4hm-fwc9-hmv6","summary":"Insecure temporary file used in com.squareup:connect","modified":"2026-03-13T21:57:16.302338Z","packages":[{"ecosystem":"Maven","name":"com.squareup:connect","purl":"pkg:maven/com.squareup/connect","ranges":["<=2.20191120.0"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}