CVE-2022-24913

Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.

Score

CVSS 3.1 5.5 Medium

Status

Modified - report@snyk.io

Published

2023-01-12

Last modified

2025-04-08

Weaknesses

CWE-377, CWE-668

Affected products

• Java-merge-sort (Java-merge-sort Project)

References

• https://github.com/cowtowncoder/java-merge-sort/commit/450fdee70b5f181c2afc5d817f293efa1a543902
• https://github.com/cowtowncoder/java-merge-sort/pull/21
• https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLUTIL-3227926