CVE-2021-28168: Local Information Disclosure in org.glassfish.jersey.core:jersey-common
Summary
CVE-2021-28168: Local information disclosure via system temporary directory. Affects org.glassfish.jersey.core:jersey-common across 2 version ranges.
>= 2.28, < 2.34
>= 3.0.0, < 3.0.2
Fixed in 2.34 or 3.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.glassfish.jersey.core:jersey-common is a Maven package that is part of the Eclipse Jersey framework. It provides functionality for handling HTTP requests and responses in Java applications. This package is vulnerable to a local information disclosure issue, which can result in the exposure of sensitive data to other users on the system.
Vulnerability Detail
The vulnerability in org.glassfish.jersey.core:jersey-common arises from the use of the File.createTempFile method, which creates a temporary file with insecure permissions in the system temporary directory. The file is created with the permissions -rw-r--r--, allowing all local users to view its contents. If the file contains sensitive information, it can be accessed by unauthorized users on the system. This vulnerability affects versions 2.28 to 2.33 and 3.0.0 to 3.0.1 of the package.
How To Fix
Latest published version: 5.0.0-M1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.28, < 2.342.34 -
>= 3.0.0, < 3.0.23.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can manually set the java.io.tmpdir system property when launching the JVM. By specifying a secure temporary directory, you can mitigate the risk of local information disclosure. However, this is not a permanent solution, and it is recommended to update to the fixed versions of the package as soon as possible.
Conclusion
In conclusion, org.glassfish.jersey.core:jersey-common is vulnerable to a local information disclosure issue that can expose sensitive data to other users on the system. To mitigate this vulnerability, it is recommended to update to the fixed versions of the package or apply the temporary workaround. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.glassfish.jersey.core:jersey-common →
FAQ
The vulnerability allows local users on the system to access sensitive information written to temporary files by the org.glassfish.jersey.core:jersey-common package.
You can mitigate the risk by updating the package to the fixed versions (2.34+ for Jersey 2.x, 3.0.2+ for Jersey 3.x) or by manually setting the java.io.tmpdir system property to a secure temporary directory.
Yes, a temporary workaround is to manually set the java.io.tmpdir system property. However, it is recommended to update to the fixed versions of the package for a permanent solution.
Versions 2.28 to 2.33 and 3.0.0 to 3.0.1 of the package are affected by this vulnerability.
You can find more information about this vulnerability in the GitHub Security Advisory GHSA-c43q-5hpj-4crv.
