CVE-2024-23454

MediumCVSS 6.2/10Last modified Jun 17, 2026

Description

Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-378

Affected software

No affected versions have been published.

Timeline

Published
Sep 25, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-234567.5Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with CVE-2024-234577.8The anti-tampering functionality of the Zscaler Client Connector can be disabled under certain conditions when an uninstall password is enfoCVE-2024-234587.8While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leadingCVE-2024-234599.8An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allows a system file to bCVE-2024-23465.4The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all CVE-2024-234607.8The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locallyCVE-2024-234615.5An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS during the upgrade process may allow a LoCVE-2024-234627.5An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client CVE-2024-234638.1Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repair App functionalityCVE-2024-234644.9In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client ConnecCVE-2024-234658.8The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability. This vulnerability allows an unaCVE-2024-234668.8SolarWinds Access Rights Manager (ARM) is susceptible to a Directory Traversal Remote Code Execution vulnerability. If exploited, this vulne