Creation of Temporary File With Insecure Permissions
CWE-378
Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
We track 13 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.0.
How this weakness is prevented
- Requirements: Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.
- Implementation: Ensure that you use proper file permissions. This can be achieved by using a safe temp file function. Temporary files should be writable and readable only by the process that owns the file.
- Implementation: Randomize temporary file names. This can also be achieved by using a safe temp-file function. This will ensure that temporary files will not be created in predictable places.
Latest Creation of Temporary File With Insecure Permissions vulnerabilities
- 7.8 High severity
mlflow/mlflow: Creation of Temporary File With Insecure Permissions
In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-writable permissions (0o777), and the `_create_model_downloading_tmp_dir()` function in `mlflow/pyfun
- 7.0 High severity
A vulnerability was detected in Enter Software Iperius Backup up to 8.7.3.
A vulnerability was detected in Enter Software Iperius Backup up to 8.7.3. Affected is an unknown function of the file C:\ProgramData\IperiusBackup\Jobs\ of the component Backup Service. Performing a manipulation results in creation of temporary file with inse
- 7.8 High severity
SupportAssist OS Recovery: Creation of Temporary File With Insecure Permissions
Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of Temporary File With Insecure Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileg
- 8.5 High severity
Remote Assist: Improper Link Resolution Before File Access
JumpCloud Remote Assist for Windows versions prior to 0.317.0 include an uninstaller that is invoked by the JumpCloud Windows Agent as NT AUTHORITY\SYSTEM during agent uninstall or update operations. The Remote Assist uninstaller performs privileged create, wr
- 7.3 High severity
run-llama/llama_index: Creation of Temporary File With Insecure Permissions
The llama-index-core package, up to version 0.12.44, contains a vulnerability in the `get_cache_dir()` function where a predictable, hardcoded directory path `/tmp/llama_index` is used on Linux systems without proper security controls. This vulnerability allow
- 7.4 High severity
Red Hat Enterprise Linux 8: Creation of Temporary File With Insecure Permissions
A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the
- 7.8 High severity
SupportAssist OS Recovery: Creation of Temporary File With Insecure Permissions
Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. A local authenticated attacker could potentially exploit this vulnerability, leading to Elevation of Privileges.
- 8.8 High severity
nixpkgs: Creation of Temporary File With Insecure Permissions
make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable enabled (the default) a local user is able to create a program that will be executed by root during sh
- 8.8 High severity
gradle: Creation of Temporary File With Insecure Permissions
Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Th
- 7.8 High severity
A vulnerability was detected in Point B Ltd Getscreen Agent up to 2.19.6/3.9.4 on Windows.
A vulnerability was detected in Point B Ltd Getscreen Agent up to 2.19.6/3.9.4 on Windows. This affects an unknown function of the file getscreen.msi of the component MSI Installer. The manipulation results in creation of temporary file with insecure permissio
- 7.8 High severity
Streamer: Creation of Temporary File With Insecure Permissions
The MSI installer for Splashtop Streamer for Windows before 3.5.8.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by placing a wevtutil.exe file in the folder.
- 9.9 Critical severity
SINEMA Remote Connect Server: Creation of Temporary File With Insecure Permissions
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly assign rights to temporary files created during its update process. This could allow an authenticated attacker with the 'M
- 7.8 High severity
PowerScale OneFS: Exposure of Resource to Wrong Sphere
Dell PowerScale OneFS 8.2.2 and above contain an elevation of privilege vulnerability. A local attacker with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE could potentially exploit this vulnerability, leading to elevation of privilege. This could potentiall