CVE-2021-21290 | Oracle PeopleSoft Enterprise PeopleTools Netty information disclosure

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

1	25
0	18

advisory_confirm_url	1
source_cve_nvd_summary	1
source_cve_assigned	1
exploit_price_0day	1
vulnerability_cvss3_meta_tempscore	1

advisory_confirm_url

source_cve_nvd_summary

source_cve_assigned

exploit_price_0day

vulnerability_cvss3_meta_tempscore

90%	30
50%	10
70%	3

90%

50%

70%

90%	30
80%	10
70%	3

90%

80%

70%

ID	Commited	User	Field	Change	Remarks	Accepted	Reason	C
11468679	07/25/2021	VulD...	confirm_url	https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2	cve.mitre.org	07/25/2021	accepted	70
11468678	07/25/2021	VulD...	cve_nvd_summary	Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.	cve.mitre.org	07/25/2021	accepted	70
11468677	07/25/2021	VulD...	cve_assigned	1608591600	cve.mitre.org	07/25/2021	accepted	70
11448383	07/21/2021	VulD...	price_0day	$0-$5k	see exploit price documentation	07/21/2021	accepted	90
11448382	07/21/2021	VulD...	cvss3_meta_tempscore	5.3	see CVSS documentation	07/21/2021	accepted	90
11448381	07/21/2021	VulD...	cvss3_meta_basescore	5.5	see CVSS documentation	07/21/2021	accepted	90
11448380	07/21/2021	VulD...	cvss3_vuldb_tempscore	5.3	see CVSS documentation	07/21/2021	accepted	90
11448379	07/21/2021	VulD...	cvss3_vuldb_basescore	5.5	see CVSS documentation	07/21/2021	accepted	90
11448378	07/21/2021	VulD...	cvss2_vuldb_tempscore	4.0	see CVSS documentation	07/21/2021	accepted	90
11448377	07/21/2021	VulD...	cvss2_vuldb_basescore	4.6	see CVSS documentation	07/21/2021	accepted	90
11448376	07/21/2021	VulD...	cvss3_vuldb_e	X	derived from historical data	07/21/2021	accepted	80
11448375	07/21/2021	VulD...	cvss2_vuldb_e	ND	derived from historical data	07/21/2021	accepted	80
11448374	07/21/2021	VulD...	cvss2_vuldb_au	S	derived from historical data	07/21/2021	accepted	80
11448373	07/21/2021	VulD...	cvss2_vuldb_rl	OF	derived from vuldb v3 vector	07/21/2021	accepted	80
11448372	07/21/2021	VulD...	cvss2_vuldb_rc	C	derived from vuldb v3 vector	07/21/2021	accepted	80
11448371	07/21/2021	VulD...	cvss2_vuldb_ai	N	derived from vuldb v3 vector	07/21/2021	accepted	80
11448370	07/21/2021	VulD...	cvss2_vuldb_ii	N	derived from vuldb v3 vector	07/21/2021	accepted	80
11448369	07/21/2021	VulD...	cvss2_vuldb_ci	C	derived from vuldb v3 vector	07/21/2021	accepted	80
11448368	07/21/2021	VulD...	cvss2_vuldb_ac	L	derived from vuldb v3 vector	07/21/2021	accepted	80
11448367	07/21/2021	VulD...	cvss2_vuldb_av	L	derived from vuldb v3 vector	07/21/2021	accepted	80

Commited

User

Field

Change

Remarks

Accepted

Reason

Oracle PeopleSoft Enterprise PeopleTools 8.57/8.58/8.59 Netty information disclosure

🔒 Login Required

Do you need the next level of professionalism?