-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.camel:camel-jira | maven | >= 3.0.0-M3, < 3.14.9 | 3.14.9 |
| org.apache.camel:camel-jira | maven | >= 3.15.0, < 3.18.8 | 3.18.8 |
| org.apache.camel:camel-jira | maven | >= 3.20.0, < 3.20.6 | 3.20.6 |
| org.apache.camel:camel-jira | maven | >= 4.0.0-M1, <= 4.0.0-M3 | 4.0.0-RC1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insecure temporary file handling in camel-jira's FileConverter. The commit diff shows the vulnerable code was replaced with Files.createTempFile() which properly handles file permissions. The original implementation constructed temporary file paths manually without ensuring secure permissions, leaving temporary files accessible to other local users. The CVE description explicitly mentions 'temporary file information disclosure' and the patch directly modifies this function's file creation logic.