You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to vulnerable library: 20200424210531/downloadResource_331c3b2c-fe8a-4960-b2fa-029c406ee470/20200424211214/guava-13.0.1.jar
Dependency Hierarchy:
❌ guava-13.0.1.jar (Vulnerable Library)
Vulnerability Details
A temp directory creation vulnerability exist in Guava versions prior to 30.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. We recommend updating Guava to version 30.0 or later, or update to Java 7 or later, or to explicitly change the permissions after the creation of the directory if neither are possible.
CVE-2020-8908 - Medium Severity Vulnerability
Vulnerable Library - guava-13.0.1.jar
Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.
Library home page: http://code.google.com/p/guava-libraries
Path to dependency file: daemon_lib/pom.xml
Path to vulnerable library: 20200424210531/downloadResource_331c3b2c-fe8a-4960-b2fa-029c406ee470/20200424211214/guava-13.0.1.jar
Dependency Hierarchy:
Vulnerability Details
A temp directory creation vulnerability exist in Guava versions prior to 30.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. We recommend updating Guava to version 30.0 or later, or update to Java 7 or later, or to explicitly change the permissions after the creation of the directory if neither are possible.
Publish Date: 2020-12-10
URL: CVE-2020-8908
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8908
Release Date: 2020-12-10
Fix Resolution: v30.0
The text was updated successfully, but these errors were encountered: