GHSA-jf2p-4gqj-849g

Suggest an improvement
Source
https://github.com/advisories/GHSA-jf2p-4gqj-849g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-jf2p-4gqj-849g/GHSA-jf2p-4gqj-849g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jf2p-4gqj-849g
Aliases
Published
2022-11-28T22:09:09Z
Modified
2024-09-26T15:00:06.813259Z
Severity
  • 2.8 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Temporary File Information Disclosure vulnerability in MPXJ
Details

Impact

On Unix-like operating systems (not Windows or macos), MPXJ's use of File.createTempFile(..) results in temporary files being created with the permissions -rw-r--r--. This means that any other user on the system can read the contents of this file. When MPXJ is reading a type of schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ.

Patches

The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes.

Workarounds

Setting java.io.tmpdir to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.

For more information

If you have any questions or comments about this advisory * Open an issue in https://github.com/joniles/mpxj

Database specific 
{
    "nvd_published_at": "2022-11-25T19:15:00Z",
    "cwe_ids": [
        "CWE-200",
        "CWE-668"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-28T22:09:09Z"
}
References

Affected packages

Maven / net.sf.mpxj:mpxj

Package

Name
net.sf.mpxj:mpxj
View open source insights on deps.dev
Purl
pkg:maven/net.sf.mpxj/mpxj

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
10.14.1

Affected versions

4.*

4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6

5.*

5.0.0
5.1.0
5.1.4
5.1.9
5.1.10
5.1.11
5.1.12
5.1.13
5.1.15
5.1.16
5.1.17
5.1.18
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.3.3
5.4.0
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0

6.*

6.0.0
6.1.0
6.1.2
6.2.0

7.*

7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.7
7.9.8

8.*

8.0.0
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1

9.*

9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3

10.*

10.0.0
10.0.1
10.0.3
10.0.4
10.0.5
10.1.0
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0

NuGet / net.sf.mpxj

Package

Name
net.sf.mpxj
View open source insights on deps.dev
Purl
pkg:nuget/net.sf.mpxj

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
10.14.1

Affected versions

4.*

4.6.0
4.6.1
4.6.2
4.7.0
4.7.1
4.7.3
4.7.4
4.7.5
4.7.6

5.*

5.0.0
5.1.0
5.1.4
5.1.5
5.1.9
5.1.10
5.1.11
5.1.12
5.1.13
5.1.15
5.1.16
5.1.17
5.1.18
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.3.3
5.4.0
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0

6.*

6.0.0
6.1.0
6.1.2
6.2.0
6.2.1

7.*

7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.7
7.9.8

8.*

8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1

9.*

9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3

10.*

10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0

NuGet / net.sf.mpxj-for-csharp

Package

Name
net.sf.mpxj-for-csharp
View open source insights on deps.dev
Purl
pkg:nuget/net.sf.mpxj-for-csharp

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
10.14.1

Affected versions

4.*

4.6.1
4.6.2
4.7.0
4.7.1
4.7.3
4.7.4
4.7.5
4.7.6

5.*

5.0.0
5.1.0
5.1.4
5.1.5
5.1.9
5.1.10
5.1.11
5.1.12
5.1.13
5.1.15
5.1.16
5.1.17
5.1.18
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.3.3
5.4.0
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0

6.*

6.0.0
6.1.0
6.1.2
6.2.0
6.2.1

7.*

7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.7
7.9.8

8.*

8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1

9.*

9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3

10.*

10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0

NuGet / net.sf.mpxj-for-vb

Package

Name
net.sf.mpxj-for-vb
View open source insights on deps.dev
Purl
pkg:nuget/net.sf.mpxj-for-vb

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
10.14.1

Affected versions

4.*

4.6.1
4.6.2
4.7.0
4.7.1
4.7.3
4.7.4
4.7.5
4.7.6

5.*

5.0.0
5.1.0
5.1.4
5.1.5
5.1.9
5.1.10
5.1.11
5.1.12
5.1.13
5.1.15
5.1.16
5.1.17
5.1.18
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.3.3
5.4.0
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.7.0
5.7.1
5.8.0
5.9.0
5.10.0
5.11.0
5.12.0
5.13.0
5.14.0

6.*

6.0.0
6.1.0
6.1.2
6.2.0
6.2.1

7.*

7.0.0
7.0.1
7.0.2
7.0.3
7.1.0
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.5.0
7.6.0
7.6.1
7.6.2
7.6.3
7.7.0
7.7.1
7.8.0
7.8.1
7.8.2
7.8.3
7.8.4
7.9.0
7.9.1
7.9.2
7.9.3
7.9.4
7.9.5
7.9.7
7.9.8

8.*

8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.8
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.2.0
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.4.0
8.5.0
8.5.1

9.*

9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3

10.*

10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0

PyPI / mpxj

Package

Name
mpxj
View open source insights on deps.dev
Purl
pkg:pypi/mpxj

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
10.14.1

Affected versions

9.*

9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.2.4
9.2.5
9.2.6
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.8.2
9.8.3

10.*

10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.1.0
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
10.7.0
10.8.0
10.9.0
10.9.1
10.10.0
10.11.0
10.12.0
10.13.0
10.14.0