PT-2023-24451 · Hutool · Hutool

Alex111998 · Publicado 2023-06-13 · Atualizado 2023-06-21 · CVE-2023-33695

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Hutool versions 5.8.17 and below

Description The issue is related to an information disclosure vulnerability. It is associated with the File.createTempFile() function located at /core/io/FileUtil.java.

Recommendations For Hutool versions 5.8.17 and below, consider updating to a version above 5.8.17 to resolve the issue. As a temporary workaround, consider restricting access to the FileUtil.java file to minimize the risk of exploitation.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-377

CWE-732

Identificadores relacionados

CVE-2023-33695

GHSA-7MCW-XMX3-7P8M

Produtos afetados

Hutool

Referências · 6

• 🔥 https://github.com/dromara/hutool/issues/3103 · Exploit
• https://github.com/dromara/hutool/commit/c33550f703f5d1d7dd71ad2992d79a5e5532ce2c · Nota
• https://github.com/dromara/hutool · Nota
• https://osv.dev/vulnerability/GHSA-7mcw-xmx3-7p8m · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-33695 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-33695 · Aviso do Fabricante