Log in Start free

Vulnerability · Published May 10, 2021 · Assigned by GitHub_M

CVE-2021-21428Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator

Critical 9.3

In plain English

A critical-severity privilege mismanagement in openapi-generator from OpenAPITools. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.4%top 71.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.openapitools:openapi-generator-online5.1.0GHSA-23x4-m842-fmwf

Affected products (as reported)

VendorProductVersions
OpenAPITools openapi-generator < 5.1.0

Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References