PT-2023-24451 · Hutool · Hutool

Alex111998 · Published 2023-06-13 · Updated 2023-06-21 · CVE-2023-33695

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Hutool versions 5.8.17 and below

Description The issue is related to an information disclosure vulnerability. It is associated with the File.createTempFile() function located at /core/io/FileUtil.java.

Recommendations For Hutool versions 5.8.17 and below, consider updating to a version above 5.8.17 to resolve the issue. As a temporary workaround, consider restricting access to the FileUtil.java file to minimize the risk of exploitation.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-377

CWE-732

Related Identifiers

CVE-2023-33695

GHSA-7MCW-XMX3-7P8M

Affected Products

Hutool

References · 6

• 🔥 https://github.com/dromara/hutool/issues/3103 · Exploit
• https://osv.dev/vulnerability/GHSA-7mcw-xmx3-7p8m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33695 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33695 · Vendor Advisory
• https://github.com/dromara/hutool/commit/c33550f703f5d1d7dd71ad2992d79a5e5532ce2c · Note
• https://github.com/dromara/hutool · Note