Skip to content

Information Disclosure in Guava

Low severity GitHub Reviewed Published Mar 25, 2021 to the GitHub Advisory Database • Updated Nov 9, 2023

Package

maven com.google.guava:guava (Maven)

Affected versions

< 32.0.0-android

Patched versions

32.0.0-android

Description

A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.

References

Published by the National Vulnerability Database Dec 10, 2020
Reviewed Mar 25, 2021
Published to the GitHub Advisory Database Mar 25, 2021
Last updated Nov 9, 2023

Severity

Low
3.3
/ 10

CVSS base metrics

Attack vector
Local
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CVE ID

CVE-2020-8908

GHSA ID

GHSA-5mg8-w23w-74h3

Source code

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.