Skip to content
OpenAdvisories

Weakness (CWE)

CWE-379: Creation of Temporary File in Directory with Insecure Permissions

Base Incomplete

The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

How to prevent it (3 mitigations)

  1. Requirements

    Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.

  2. Implementation

    Try to store sensitive tempfiles in a directory which is not world readable -- i.e., per-user directories.

  3. Implementation

    Avoid using vulnerable temp file functions.

Source: MITRE CWE-379

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.3
    CVE-2023-38533

    A vulnerability has been identified in TIA Administrator (All versions < V3 SP2). The affected component creates tempor…

    Siemens TIA Administrator ICS / OT
  • Low 3.0
    CVE-2021-21331

    DataDog API Client contains a Local Information Disclosure Vulnerability

    The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the API Client. The Datadog API is executed on a unix-like system with multiple users. The API is used to …

    Datadog datadog-api-client-java com.datadoghq:datadog-api-client Maven