CVSS 3.1
7.0 highCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2021-21428
High (7.0) in openapi-generator openapi generator. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in org.openapitools:openapi-generator-online 5.1.0.
Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-668, CWE-269
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openapi-generator:openapi_generator
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-23x4-m842-fmwf | Maven | org.openapitools:openapi-generator-online | <5.1.0 | 5.1.0 |