Skip to content
OpenAdvisories

Weakness (CWE)

CWE-379: Creation of Temporary File in Directory with Insecure Permissions

Base Incomplete

The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

How to prevent it (3 mitigations)

  1. Requirements

    Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.

  2. Implementation

    Try to store sensitive tempfiles in a directory which is not world readable -- i.e., per-user directories.

  3. Implementation

    Avoid using vulnerable temp file functions.

Source: MITRE CWE-379

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.5
    CVE-2024-9950 Public exploit

    Abuse of Unauthenticated Compliance Recheck in SecureConnector

    A vulnerability in Forescout SecureConnector v11.3.07.0109 on Windows allows unauthenticated user to modify compliance scripts due to insecure temporary directory.

    Forescout SecureConnector
  • High 8.8
    CVE-2024-36821 Public exploit

    Insecure permissions in Linksys Velop WiFi 5 (WHW01v1) 1.1.13.202617 allows attackers to escalate privileges from Guest…

  • High 7.8
    CVE-2022-27772 Public exploit

    Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot

    spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only…

    org.springframework.boot:spring-boot Maven