Vulnerability Description
Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Eclipse | Jersey | >= 2.28, < 2.34 |
| Oracle | Communications Cloud Native Core Policy | 1.15.0 |
| Oracle | Communications Cloud Native Core Unified Data Repository | 1.15.0 |
Related Weaknesses (CWE)
References
- https://github.com/eclipse-ee4j/jersey/pull/4712PatchThird Party Advisory
- https://github.com/eclipse-ee4j/jersey/security/advisories/GHSA-c43q-5hpj-4crvThird Party Advisory
- https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdb
- https://lists.apache.org/thread.html/r280438f7cb4b3b1c9dfda9d7b05fa2a5cfab68618c
- https://lists.apache.org/thread.html/r305fb82e5c005143c1e2ec986a19c0a44f42189ab2
- https://lists.apache.org/thread.html/r4066176a7352e021d7a81af460044bde8d57f40e98
- https://lists.apache.org/thread.html/r42fef440487a04cf5e487a9707ef5119d2dd5b8099
- https://lists.apache.org/thread.html/r454f38e85db149869c5a92c993c402260a4f8599bf
- https://lists.apache.org/thread.html/r6dadc8fe82071aba841d673ffadf34728bff435779
- https://lists.apache.org/thread.html/r96658b899fcdbf04947257d201dc5a0abdbb5fb0a8
- https://lists.apache.org/thread.html/ra2722171d569370a9e15147d9f3f6138ad9a188ee8
- https://lists.apache.org/thread.html/ra3290fe51b4546fac195724c4187c4cb7fc5809bc5
- https://lists.apache.org/thread.html/ra3d7cd37fc794981a885332af2f8df0d873753380e
- https://lists.apache.org/thread.html/rafc3c4cee534f478cbf8acf91e48373e291a21151f
- https://lists.apache.org/thread.html/rc288874c330b3af9e29a1a114c5e0d24fff7a79eaa
FAQ
What is CVE-2021-28168?
CVE-2021-28168 is a vulnerability with a CVSS score of 6.2 (MEDIUM). Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of th...
How severe is CVE-2021-28168?
CVE-2021-28168 has been rated MEDIUM with a CVSS base score of 6.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-28168?
Check the references section above for vendor advisories and patch information. Affected products include: Eclipse Jersey, Oracle Communications Cloud Native Core Policy, Oracle Communications Cloud Native Core Unified Data Repository.