Weakness (CWE)

CWE-379: Creation of Temporary File in Directory with Insecure Permissions

Base Incomplete

The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

How to prevent it (3 mitigations)

Requirements

Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.
Implementation

Try to store sensitive tempfiles in a directory which is not world readable -- i.e., per-user directories.
Implementation

Avoid using vulnerable temp file functions.

Source: MITRE CWE-379

All Critical High Medium Low Exploited only Public exploit

0 results · Clear filters · Feed

Nothing found.