CWE-379: Creation of Temporary File in Directory with Insecure Permissions, page 2

The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

What the weakness is: CWE-379 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

1. 6.5CVE-2021-39827EPSS 1.5%2021-09-27

   Adobe Digital Editions 4.5.11.187646 (and earlier) are affected by an arbitrary file write vulnerability in the Digital Editions installer. An authenticated attacker could leverage this vulnerability to write an arbitrary file to the syste…

2. 7.4CVE-2021-28613EPSS 0.5%2021-09-27

   Adobe Creative Cloud Desktop Application version 5.4 (and earlier) is affected by a file handling vulnerability that could allow an attacker to arbitrarily overwrite a file. Exploitation of this issue requires local access, administrator p…

3. 6.5CVE-2021-28568EPSS 0.6%2021-09-08

   Adobe Genuine Services version 7.1 (and earlier) is affected by an Insecure file permission vulnerability during installation process. A local authenticated attacker could leverage this vulnerability to achieve privilege escalation in the …

4. 7.3CVE-2021-36002EPSS 0.5%2021-09-01

   Adobe Captivate version 11.5.5 (and earlier) is affected by an Creation of Temporary File In Directory With Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current user. The attacker must…

5. 6.1CVE-2021-28633EPSS 0.5%2021-08-24

   Adobe Creative Cloud Desktop Application (installer) version 2.4 (and earlier) is affected by an Insecure temporary file creation vulnerability. An attacker could leverage this vulnerability to cause arbitrary file overwriting in the conte…

6. 5.5CVE-2021-28623EPSS 0.5%2021-06-28

   Adobe Premiere Elements version 5.2 (and earlier) is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high privi…

7. 5.5CVE-2021-28597EPSS 0.5%2021-06-28

   Adobe Photoshop Elements version 5.2 (and earlier) is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high priv…

8. 7.8CVE-2021-31411EPSS 0.2%2021-05-05

   Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0…

9. 5.5CVE-2021-28168EPSS 0.9%2021-04-22

   Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the p…

10. 7.8CVE-2021-21100EPSS 1.7%2021-04-15

    Adobe Digital Editions version 4.5.11.187245 (and earlier) is affected by a Privilege Escalation vulnerability during installation. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary file system write in the…

11. 7.8CVE-2021-29428EPSS 0.5%2021-04-13

    In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Gradle builds could be vulnerable to a local privilege …

12. 6.1CVE-2021-21068EPSS 0.6%2021-03-12

    Adobe Creative Cloud Desktop Application version 5.3 (and earlier) is affected by a file handling vulnerability that could allow an attacker to cause arbitrary file overwriting. Exploitation of this issue requires physical access and user …

13. 7.0CVE-2021-21363EPSS 0.4%2021-03-11

    swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before versio…

14. 3.3CVE-2021-21331EPSS 0.6%2021-03-03

    The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the API Client. The Datadog API is executed on a unix-like system with multiple users.…

15. 5.5CVE-2021-21290EPSS 1.8%2021-02-08

    Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like …

16. 7.0CVE-2020-27216EPSS 4.4%2020-10-23

    In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated use…

17. 7.5CVE-2020-11979EPSS 7.8%2020-10-01

    As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new o…

18. 5.5CVE-2020-8831EPSS 0.7%2020-04-22

    Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise…

19. 7.8CVE-2016-9486EPSS 1.3%2018-07-13

    On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable full functionality of the agent. The typical configuration is for the agent to run as a Windows ser…

20. 6.1CVE-2013-1815EPSS 0.5%2013-04-10

    A flaw was found in PackStack. This vulnerability allows a local user to modify deployed systems by changing the answer file, which is created in insecure directories such as /tmp or the current working directory. This insecure file creati…