Vulnerability · Published Nov 11, 2022 · Assigned by VulDB

CVE-2022-3952ManyDesigns Portofino WarFileLauncher.java createTempDir temp file

Low 2.6

In plain English

A low-severity security flaw in Portofino from ManyDesigns. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.6Low

Exploit odds (30 days)0.6%top 51.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in ManyDesigns Portofino 5.3.2 and classified as problematic. Affected by this vulnerability is the function createTempDir of the file WarFileLauncher.java. The manipulation leads to creation of temporary file in directory with insecure permissions. Upgrading to version 5.3.3 is able to address this issue. The name of the patch is 94653cb357806c9cf24d8d294e6afea33f8f0775. It is recommended to upgrade the affected component. The identifier VDB-213457 was assigned to this vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.manydesigns:portofino	5.3.3	GHSA-925r-r6rp-2jj7

Affected products (as reported)

Vendor	Product	Versions
ManyDesigns	Portofino	5.3.2

Weakness: CWE-377 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References