CVE-2021-23331 json
Insecure Temporary File
published 5y ago modified 4mo ago also GHSA-q4hm-fwc9-hmv6 , EUVD-2021-1376
- cvss
- 4.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workaround fix for this issue is to set the system property java.io.tmpdir to a safe directory as remediation. Note: This version of the SDK is end of life and no longer maintained, please upgrade to the latest version.
Is CVE-2021-23331 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.4 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:W/RC:C |
| CNA | 3.1 | 4.4 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.squareup:connect | <=2.20191120.0 |
no fix listed |
Affected products
- n/a com.squareup:connect
Classification
- Weakness
-
- CWE-377 DEPRECATED: Insecure Temporary File
References
-
snyk.io
/vuln/SNYK-JAVA-COMSQUAREUP-1065988
web, third-party-advisory
-
github.com
/square/connect-java-sdk/blob/master/src/main/java/com/squareup/connect/ApiClient.java%23L613
web, broken-link
-
nvd.nist.gov
/vuln/detail/CVE-2021-23331
advisory
-
github.com
/square/connect-java-sdk
package
Sources
- CVE List CVE-2021-23331
- GitHub Advisory GHSA-q4hm-fwc9-hmv6
- NVD CVE-2021-23331
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.