CVE-2021-21428: falha crítica em OpenAPITools openapi-generator
Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.4%
Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
OpenAPITools · openapi-generatorCVEs relacionadas — OpenAPITools openapi-generator
No mesmo produto, das mais perigosas para as menos.
CVE-2024-35219HIGHOpenAPI Generator Online - Arbitrary File Read/DeleteEPSS 3.6%CVE-2021-21430MEDIUMCreation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala codeEPSS 0.4%CVE-2021-21429MEDIUMCreation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven pluginEPSS 0.3%