Weakness (CWE)
CWE-379: Creation of Temporary File in Directory with Insecure Permissions
The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
How to prevent it (3 mitigations)
-
Requirements
Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.
-
Implementation
Try to store sensitive tempfiles in a directory which is not world readable -- i.e., per-user directories.
-
Implementation
Avoid using vulnerable temp file functions.
Source: MITRE CWE-379
82 results · Feed
-
Medium 6.1
Packstack: red hat openstack: packstack: unauthorized system modification via insecure answer file creation
A flaw was found in PackStack. This vulnerability allows a local user to modify deployed systems by changing the answer file, which is created in insecure directories such as /tmp or the current working directory. This insecure file creation could lead to una…
-
Medium —
Moodle Double-Caches Content, Potentially Writing to a File System's Tmp Directory
The theme implementation in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 triggers duplicate caching of Cascading Style Sheets (CSS) and JavaScript content, which allows remote attackers to bypass intended access restrictions and write to an operating-syst…