CVE-2018-25068: Insecure Temporary File in globalpom-utils
Summary
CVE-2018-25068: globalpom-utils has Insecure Temporary File. Affects com.anrisoftware.globalpom:globalpomutils versions < 4.5.1. Fixed in 4.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
globalpom-utils is a Maven package that provides utility classes for various purposes. It is used to manage file resources in Java applications. The package includes a function called createTmpDir in the FileResourceManagerProvider.java file, which is responsible for creating temporary directories. However, versions up to 4.5.0 of globalpom-utils are vulnerable to an insecure temporary file issue.
Vulnerability Detail
The vulnerability in globalpom-utils allows for the creation of insecure temporary files. This can be exploited remotely and has been classified as critical. The specific function createTmpDir in FileResourceManagerProvider.java is affected. Attackers can manipulate this function to create temporary files with insecure permissions, potentially leading to unauthorized access or other security breaches. The vulnerability has been assigned the identifier CVE-2018-25068 and has a CVSS score of 9.8.
How To Fix
Minimum fixed version
4.5.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version.
Conclusion
In conclusion, the globalpom-utils package up to version 4.5.0 is vulnerable to an insecure temporary file issue. This can be exploited remotely and has the potential for serious security breaches. It is highly recommended to upgrade to version 4.5.1, which includes a patch for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.anrisoftware.globalpom:globalpomutils →
FAQ
globalpom-utils is a Maven package that provides utility classes for managing file resources in Java applications.
The vulnerability allows for the creation of insecure temporary files, which can lead to unauthorized access or other security breaches.
To fix this vulnerability, upgrade globalpom-utils to version 4.5.1, which includes a patch for the insecure temporary file issue.
There is no specific workaround mentioned for this vulnerability. Upgrading to the fixed version is the recommended solution.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
