CVE-2021-28168

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-378 CWE-379 CWE-668

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-281695.3For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to a CVE-2021-281705.3In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be CVE-2021-281719.8The Vangene deltaFlow E-platform does not take properly protective measures. Attackers can obtain privileged permissions remotely by tamperi CVE-2021-281727.5There is a Path Traversal vulnerability in the file download function of Vangene deltaFlow E-platform. Remote attackers can access credentia CVE-2021-281739.8The file upload function of Vangene deltaFlow E-platform does not perform access controlled properly. Remote attackers can upload and execut CVE-2021-281746.5Mitake smart stock selection system contains a broken authentication vulnerability. By manipulating the parameters in the URL, remote attack CVE-2021-281754.9The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting i CVE-2021-281764.9The DNS configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a CVE-2021-281774.9The LDAP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in CVE-2021-281784.9The UEFI configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in CVE-2021-281794.9The specific function in ASUS BMC’s firmware Web management page (Media support configuration setting) does not verify the string length ent CVE-2021-281804.9The specific function in ASUS BMC’s firmware Web management page (Audit log configuration setting) does not verify the string length entered