Trgpa

**Name of the Vulnerable Software and Affected Versions** spring-boot versions prior to version v2.2.11.RELEASE **Description** The issue is related to temporary directory hijacking, impacting the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. This vulnerability allows a local attacker to potentially take over the application if they gain permission to write in the temporary directory used by embedded web servers like Tomcat and Jetty. The vulnerability exists due to a race condition where an attacker can create a directory before the Java code, allowing them to write or read files in that directory. This issue affects Unix-like systems and older versions of Mac OSX and Windows that share the system temporary directory among all users. **Recommendations** For spring-boot versions prior to version v2.2.11.RELEASE, update to version v2.2.11.RELEASE or later to resolve the issue. As a temporary workaround, consider setting the java.io.tmpdir system environment variable to a directory exclusively owned by the executing user to mitigate the vulnerability.