GHSA-vm69-474v-7q2w

Suggest an improvement
Source
https://github.com/advisories/GHSA-vm69-474v-7q2w
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vm69-474v-7q2w/GHSA-vm69-474v-7q2w.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vm69-474v-7q2w
Aliases
Published
2022-05-05T02:48:41Z
Modified
2024-12-05T05:54:10.545067Z
Summary
Incorrect Default Permissions in Apache Commons FileUpload
Details

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.

Database specific 
{
    "github_reviewed": true,
    "nvd_published_at": "2013-03-15T20:55:00Z",
    "cwe_ids": [
        "CWE-276"
    ],
    "github_reviewed_at": "2022-07-08T18:59:32Z",
    "severity": "LOW"
}
References

Affected packages

Maven / commons-fileupload:commons-fileupload

Package

Name
commons-fileupload:commons-fileupload
View open source insights on deps.dev
Purl
pkg:maven/commons-fileupload/commons-fileupload

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0
Fixed
1.2.2

Affected versions

1.*
1.0
1.1
1.1.1
1.2
1.2.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vm69-474v-7q2w/GHSA-vm69-474v-7q2w.json"