Vulnerability Details : CVE-2021-21428
Potential exploit
Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.
Products affected by CVE-2021-21428
- cpe:2.3:a:openapi-generator:openapi_generator:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-21428
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 5 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-21428
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.4
|
MEDIUM | AV:L/AC:M/Au:N/C:P/I:P/A:P |
3.4
|
6.4
|
NIST | |
7.0
|
HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.0
|
5.9
|
NIST | |
9.3
|
CRITICAL | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
2.5
|
6.0
|
GitHub, Inc. |
CWE ids for CVE-2021-21428
-
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.Assigned by: security-advisories@github.com (Secondary)
-
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-21428
-
https://github.com/OpenAPITools/openapi-generator/pull/8788
[online] use Files.createTempFile to address security concerns by wing328 · Pull Request #8788 · OpenAPITools/openapi-generator · GitHubPatch;Third Party Advisory
-
https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-23x4-m842-fmwf
OpenAPI-Generator online generator: Local Privilege Escalation Vulnerability via System Temp Directory · Advisory · OpenAPITools/openapi-generator · GitHubExploit;Third Party Advisory
Jump to