Creation of Temporary File in Directory with Insecure Permissions
CWE-379
The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
We track 27 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.9.
How this weakness is prevented
- Requirements: Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.
- Implementation: Try to store sensitive tempfiles in a directory which is not world readable -- i.e., per-user directories.
- Implementation: Avoid using vulnerable temp file functions.
Latest Creation of Temporary File in Directory with Insecure Permissions vulnerabilities
- 7.8 High severity
TorchServe: Creation of Temporary File in Directory with Insecure Permissions
In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation.
- 9.8 Critical severity
GnuPG: Creation of Temporary File in Directory with Insecure Permissions
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An atta
- 8.4 High severity
Eclipse Ankaios: Incorrect Default Permissions
In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictable path derived from the agent name and a hash of the workload's runtime configuration. If a directory or FIFO already
- 7.1 High severity
Windows 10 Version 1607: Creation of Temporary File in Directory with Insecure Permissions
Creation of temporary file in directory with insecure permissions in Windows Error Reporting allows an authorized attacker to perform tampering locally.
- 7.8 High severity
aws-fpga: Creation of Temporary File in Directory with Insecure Permissions
Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit (aws-fpga) before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shel
- 7.0 High severity
HP ImageDiags: Creation of Temporary File in Directory with Insecure Permissions
A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.0.0.36. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls.
- 7.7 High severity
HP Easy Start for macOS: Creation of Temporary File in Directory with Insecure Permissions
Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.
- 8.8 High severity
servereye Windows Agent (Sensorhub): External Control of File Name or Path
The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running as SYSTEM, periodic
- 7.3 High severity
HP Dock Accessory: Creation of Temporary File in Directory with Insecure Permissions
A potential security vulnerability has been identified in the HP Accessory WMI Provider installer for some HP Docking Stations, which might allow escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potentia
- 7.3 High severity
pi: Creation of Temporary File in Directory with Insecure Permissions
Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who c
- 7.8 High severity
opentelemetry-dotnet: Creation of Temporary File in Directory with Insecure Permissions
OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exporter.OpenTelemetryProtocol silently fell back to Path.GetTempPath() when OTEL_DOTN
- 7.0 High severity
mlflow/mlflow: Creation of Temporary File in Directory with Insecure Permissions
In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This vulnerability allows an attacker with write access to the `/tmp` directory to exploit a race condition
- 7.3 High severity
InstallShield: Creation of Temporary File in Directory with Insecure Permissions
A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured. All supported versions (InstallShield 2023 R2, InstallShield 2022 R2 and InstallShield 2021 R2) are a
- 8.8 High severity
nixpkgs: Creation of Temporary File With Insecure Permissions
make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable enabled (the default) a local user is able to create a program that will be executed by root during sh
- 8.8 High severity
gradle: Creation of Temporary File With Insecure Permissions
Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Th
- 7.8 High severity
SecureConnector: Creation of Temporary File in Directory with Insecure Permissions
A vulnerability in Forescout SecureConnector v11.3.07.0109 on Windows allows unauthenticated user to modify compliance scripts due to insecure temporary directory.
- 7.8 High severity
Installer: Creation of Temporary File in Directory with Insecure Permissions
A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to insecure privilege management.
- 7.8 High severity
SysTrack LsiAgent Installer: Creation of Temporary File in Directory with Insecure Permissions
Lakeside Software’s SysTrack LsiAgent Installer version 10.7.8 for Windows contains a local privilege escalation vulnerability which allows attackers SYSTEM level access.
- 7.8 High severity
Splashtop Software Updater: Creation of Temporary File in Directory with Insecure Permissions
The C:\Program Files (x86)\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at C:\Windows\Temp~nsu.tmp and copies itself to it as Au_.exe. The C:\Windows\Temp~nsu.tmp\Au_.exe file is automatically launched as SYSTEM when the system rebo
- 7.8 High severity
pyinstaller: Incorrect Permission Assignment for Critical Resource
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise
- 7.8 High severity
Red Hat Enterprise Linux 7: Exposure of Resource to Wrong Sphere
A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the sy
- 7.8 High severity
Atera Agent Package Availability: Creation of Temporary File in Directory with Insecure Permissions
The C:\Windows\Temp\Agent.Package.Availability\Agent.Package.Availability.exe file is automatically launched as SYSTEM when the system reboots. Since the C:\Windows\Temp\Agent.Package.Availability folder inherits permissions from C:\Windows\Temp and Agent.Pack
- 7.8 High severity
Dell Power Manager (DPM): Creation of Temporary File in Directory with Insecure Permissions
Dell Power Manager, Versions 3.3 to 3.14 contains an Improper Access Control vulnerability. A low-privileged malicious user may potentially exploit this vulnerability to perform arbitrary code execution with limited access.
- 7.8 High severity
Acrobat Reader: Creation of Temporary File in Directory with Insecure Permissions
Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current u
- 7.8 High severity
Acrobat Reader: Creation of Temporary File in Directory with Insecure Permissions
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in
- 7.8 High severity
Acrobat Reader: Exposure of Resource to Wrong Sphere
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in
- 7.5 High severity
keylime: Exposure of Resource to Wrong Sphere
In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations.