Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2020-8908— Temp directory permission issue in Guava

CVSS 3.3 · Low EPSS 0.07% · P22
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2020-8908

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Temp directory permission issue in Guava
Source: NVD (National Vulnerability Database)
Vulnerability Description
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
创建拥有不安全权限的临时文件
Source: NVD (National Vulnerability Database)
Vulnerability Title
Google Guava 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Google Guava是美国谷歌（Google）公司的一款包括图形库、函数类型、I/O和字符串处理等的Java核心库。 Google Guava 30.0版本之前存在访问控制错误漏洞，该漏洞源于Guava存在一个临时目录创建漏洞，允许访问机器的攻击者可利用该漏洞潜在地访问由Guava com.google.common.io. Files. createTempDir() 创建的临时目录中的数据。攻击者可以利用该漏洞访问特殊目录。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
Google LLCGuava 1.0 ~ 32.0 -

II. Public POCs for CVE-2020-8908

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-8908

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same product: Guava
Same vendor: Google LLC
Same weakness: CWE-378

V. Comments for CVE-2020-8908

No comments yet

Leave a comment