CVE-2023-2976

CWE-552 — Files Accessible to External PartiesCWE-37916 documents9 sources
Severity
7.1HIGH
EPSS
0.1%
top 79.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Google Guava
Timeline
PublishedJun 14
Latest updateOct 15

Description

Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5google/guava1.0 — 32.0.0
▶NVDgoogle/guava< 32.0.0
▶Mavencom.google.guava:guava1.0 — 32.0.0-android
▶Debianguava-libraries< 32.0.1-1+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
CVE-2023-2976: Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1↗2023-06-14
▶
CVEList
Use of temporary directory for file creation in `FileBackedOutputStream` in Guava↗2023-06-14
▶
OSV
Guava vulnerable to insecure use of temporary directory↗2023-06-14
▶
GHSA
Guava vulnerable to insecure use of temporary directory↗2023-06-14
▶

📋Vendor Advisories

11
Oracle
Oracle Oracle Insurance Applications Risk Matrix: EWPS (Google Guava) — CVE-2023-2976↗2025-10-15
▶
Oracle
Oracle Oracle JD Edwards Risk Matrix: Monitoring and Diagnostics SEC (Google Guava) — CVE-2023-2976↗2025-01-15
▶
Oracle
Oracle Oracle Blockchain Platform Risk Matrix: Blockchain Cloud Service Console (Google Guava) — CVE-2023-2976↗2024-10-15
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: NextGen Installer (Google Guava) — CVE-2023-2976↗2024-07-15
▶
Oracle
Oracle Oracle Commerce Risk Matrix: Content Acquisition System, Workbench (Google Guava) — CVE-2023-2976↗2024-04-15
▶