Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2020-27216

Creation of Temporary File With Insecure Permissions

Published: Oct 23, 2020 | Modified: Nov 21, 2024
CVSS 3.x
7
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
4.4 MEDIUM
AV:L/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
7 MODERATE
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2020-27216
CWEhttps://cwe.mitre.org/data/definitions/378.html

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the systems temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

Weakness

Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.

Affected Software

NameVendorStart VersionEnd Version
JettyEclipse1.0 (including)9.3.29 (excluding)
JettyEclipse9.4.0 (including)9.4.32 (including)
JettyEclipse10.0.0-alpha1 (including)10.0.0-alpha1 (including)
JettyEclipse10.0.0-beta0 (including)10.0.0-beta0 (including)
JettyEclipse10.0.0-beta1 (including)10.0.0-beta1 (including)
JettyEclipse10.0.0-beta2 (including)10.0.0-beta2 (including)
JettyEclipse11.0.0-alpha1 (including)11.0.0-alpha1 (including)
JettyEclipse11.0.0-beta1 (including)11.0.0-beta1 (including)
JettyEclipse11.0.0-beta2 (including)11.0.0-beta2 (including)
Red Hat AMQRedHat*
Red Hat AMQ LTS 7.4.6RedHatjetty*
Red Hat Developer ToolsRedHatrh-eclipse-1:4.17-6.el7_9*
Red Hat Developer ToolsRedHatrh-eclipse-ant-0:1.10.9-1.2.el7*
Red Hat Developer ToolsRedHatrh-eclipse-antlr32-0:3.2-28.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-apache-sshd-1:2.4.0-5.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-apiguardian-0:1.1.0-6.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-args4j-0:2.33-12.2.el7*
Red Hat Developer ToolsRedHatrh-eclipse-batik-0:1.13-1.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-bouncycastle-0:1.67-1.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-cbi-plugins-0:1.1.7-8.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-decentxml-0:1.4-24.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-ecj-1:4.17-1.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-eclipse-1:4.17-2.2.el7_9*
Red Hat Developer ToolsRedHatrh-eclipse-eclipse-ecf-0:3.14.17-1.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-eclipse-egit-0:5.9.0-1.1.el7_9*
Red Hat Developer ToolsRedHatrh-eclipse-eclipse-emf-1:2.23.0-1.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-eclipse-gef-0:3.11.0-14.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-eclipse-jgit-0:5.9.0-1.1.el7_9*
Red Hat Developer ToolsRedHatrh-eclipse-eclipse-license-0:2.0.2-2.1.el7_9*
Red Hat Developer ToolsRedHatrh-eclipse-eclipse-m2e-core-0:1.16.2-3.1.el7_9*
Red Hat Developer ToolsRedHatrh-eclipse-eclipse-m2e-workspace-0:0.4.0-16.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-eclipse-mpc-0:1.8.4-1.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-eclipse-pydev-1:8.0.0-1.1.el7_9*
Red Hat Developer ToolsRedHatrh-eclipse-eclipse-subclipse-0:4.3.0-8.1.el7_9*
Red Hat Developer ToolsRedHatrh-eclipse-eclipse-webtools-0:3.19.0-1.1.el7_9*
Red Hat Developer ToolsRedHatrh-eclipse-ed25519-java-0:0.3.0-8.2.el7*
Red Hat Developer ToolsRedHatrh-eclipse-felix-gogo-command-0:1.0.2-12.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-felix-gogo-parent-0:4-6.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-felix-gogo-runtime-0:1.1.0-8.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-felix-gogo-shell-0:1.1.0-6.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-felix-scr-0:2.1.16-7.2.el7*
Red Hat Developer ToolsRedHatrh-eclipse-javaewah-0:1.1.6-10.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-javaparser-0:3.14.16-1.2.el7*
Red Hat Developer ToolsRedHatrh-eclipse-jchardet-0:1.1-23.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-jctools-0:3.1.0-1.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-jetty-0:9.4.33-1.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-jffi-0:1.2.23-2.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-jgit-0:5.9.0-1.2.el7*
Red Hat Developer ToolsRedHatrh-eclipse-jna-0:5.4.0-7.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-jnr-constants-0:0.9.12-7.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-jnr-ffi-0:2.1.8-9.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-jnr-netdb-0:1.1.6-11.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-jnr-posix-0:3.0.47-7.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-jnr-x86asm-0:1.0.2-22.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-jsch-agent-proxy-0:0.0.8-14.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-junit5-0:5.7.0-1.2.el7*
Red Hat Developer ToolsRedHatrh-eclipse-jython-0:2.7.1-14.1.el7_9*
Red Hat Developer ToolsRedHatrh-eclipse-jzlib-0:1.1.3-15.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-lucene-0:8.6.3-1.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-maven-archetype-0:3.2.0-1.1.el7_9*
Red Hat Developer ToolsRedHatrh-eclipse-maven-indexer-0:6.0.0-5.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-netty-0:4.1.51-1.2.el7*
Red Hat Developer ToolsRedHatrh-eclipse-objectweb-asm-0:8.0.1-1.2.el7*
Red Hat Developer ToolsRedHatrh-eclipse-opentest4j-0:1.2.0-4.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-os-maven-plugin-0:1.6.2-2.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-sac-0:1.3-34.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-sat4j-0:2.3.5-20.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-sequence-library-0:1.0.3-8.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-sqljet-0:1.1.10-18.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-stringtemplate-0:3.2.1-24.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-svnkit-1:1.8.12-9.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-takari-polyglot-0:0.4.5-2.1.el7_9*
Red Hat Developer ToolsRedHatrh-eclipse-trilead-ssh2-0:217.21-3.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-tycho-0:1.7.0-2.5.el7_9*
Red Hat Developer ToolsRedHatrh-eclipse-univocity-parsers-0:2.9.0-1.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-ws-commons-util-0:1.0.2-14.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-xmlgraphics-commons-0:2.4-1.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-xml-maven-plugin-0:1.0.2-7.1.el7*
Red Hat Developer ToolsRedHatrh-eclipse-xmlrpc-1:3.1.3-27.1.el7*
Red Hat Fuse 7.9RedHatjetty*
Red Hat Migration Toolkit for Containers 1.4RedHatrhmtc/openshift-migration-controller-rhel8:v1.4.6-4*
Red Hat Migration Toolkit for Containers 1.4RedHatrhmtc/openshift-migration-log-reader-rhel8:v1.4.6-4*
Red Hat Migration Toolkit for Containers 1.4RedHatrhmtc/openshift-migration-must-gather-rhel8:v1.4.6-4*
Red Hat Migration Toolkit for Containers 1.4RedHatrhmtc/openshift-migration-operator-bundle:v1.4.6-5*
Red Hat Migration Toolkit for Containers 1.4RedHatrhmtc/openshift-migration-registry-rhel8:v1.4.6-4*
Red Hat Migration Toolkit for Containers 1.4RedHatrhmtc/openshift-migration-rsync-transfer-rhel8:v1.4.6-4*
Red Hat Migration Toolkit for Containers 1.4RedHatrhmtc/openshift-migration-ui-rhel8:v1.4.6-4*
Red Hat Migration Toolkit for Containers 1.4RedHatrhmtc/openshift-migration-velero-plugin-for-aws-rhel8:v1.4.6-4*
Red Hat Migration Toolkit for Containers 1.4RedHatrhmtc/openshift-migration-velero-plugin-for-gcp-rhel8:v1.4.6-3*
Red Hat Migration Toolkit for Containers 1.4RedHatrhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8:v1.4.6-4*
Red Hat Migration Toolkit for Containers 1.4RedHatrhmtc/openshift-migration-velero-restic-restore-helper-rhel8:v1.4.6-5*
Red Hat Migration Toolkit for Containers 1.4RedHatrhmtc/openshift-migration-velero-rhel8:v1.4.6-5*
Red Hat Migration Toolkit for Containers 1.4RedHatrhmtc/openshift-velero-plugin-rhel8:v1.4.6-4*
Red Hat OpenShift Container Platform 3.11RedHatjenkins-0:2.289.1.1624365627-1.el7*
Red Hat OpenShift Container Platform 4.5RedHatjenkins-0:2.277.3.1623846768-1.el7*
Red Hat OpenShift Container Platform 4.6RedHatjenkins-0:2.277.3.1623853726-1.el8*
JettyUbuntutrusty*
JettyUbuntutrusty/esm*
JettyUbuntuxenial*
Jetty8Ubuntutrusty*
Jetty8Ubuntutrusty/esm*
Jetty8Ubuntuxenial*
Jetty9Ubuntubionic*
Jetty9Ubuntufocal*
Jetty9Ubuntugroovy*
Jetty9Ubuntutrusty*
Jetty9Ubuntuupstream*
Jetty9Ubuntuxenial*

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use