-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from using File.createTempFile() which doesn't set secure permissions on Unix systems. The commit diff shows these two functions were patched by replacing File.createTempFile() with Files.createTempFile() which handles permissions correctly. These are the core functions handling temporary file creation for schedule processing, directly matching the vulnerability description about transient files being readable by other users.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| net.sf.mpxj:mpxj | maven | < 10.14.1 | 10.14.1 |
| net.sf.mpxj | nuget | < 10.14.1 | 10.14.1 |
| net.sf.mpxj-for-csharp | nuget | < 10.14.1 | 10.14.1 |
| net.sf.mpxj-for-vb | nuget | < 10.14.1 | 10.14.1 |
| mpxj | pip | < 10.14.1 | 10.14.1 |