CVE-2021-28168 (CNNVD-202104-1669)

MEDIUM
中文标题:
Maxim Nesen jersey 安全漏洞
英文标题:
Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosur...
CVSS分数: 6.2
发布时间: 2021-04-22 17:35:14
漏洞类型: 其他
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v3
漏洞描述
中文描述:

Maxim Nesen jersey是Maxim Nesen开源的一个应用软件。一个REST框架，提供JAX-RS参考实现等。 Maxim Nesen jersey 存在安全漏洞，该漏洞源于包含一个本地信息公开漏洞。这是由于文件的使用createTempFile在系统临时目录中创建一个具有权限的文件:-rw-r——r——。

英文描述:

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.

CWE类型:
CWE-668 CWE-379 CWE-378
标签:
（暂无数据）
受影响产品
厂商 产品 版本 版本范围 平台 CPE
The Eclipse Foundation Eclipse Jersey - < unspecified - cpe:2.3:a:the_eclipse_foundation:eclipse_jersey:*:*:*:*:*:*:*:*
eclipse jersey * - - cpe:2.3:a:eclipse:jersey:*:*:*:*:*:*:*:*
oracle communications_cloud_native_core_policy 1.15.0 - - cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*
oracle communications_cloud_native_core_unified_data_repository 1.15.0 - - cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
[kafka-jira] 20210429 [GitHub] [kafka] xjin-Confluent opened a new pull request #10614: MINOR: Upgrade jersey to 2.34 mailing-list
cve.org
访问
[kafka-jira] 20210505 [jira] [Created] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02 mailing-list
cve.org
访问
[kafka-dev] 20210505 [jira] [Created] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02 mailing-list
cve.org
访问
[kafka-jira] 20210505 [GitHub] [kafka] shayelkin opened a new pull request #10636: MINOR: Bump Jersey deps to 2.34 due to CVE-2021-28168 mailing-list
cve.org
访问
[kafka-jira] 20210506 [jira] [Assigned] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02 mailing-list
cve.org
访问
[kafka-jira] 20210506 [jira] [Commented] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02 mailing-list
cve.org
访问
[kafka-jira] 20210506 [GitHub] [kafka] dongjinleekr opened a new pull request #10641: KAFKA-12752: CVE-2021-28168 upgrade jersey to 2.34 or 3.02 mailing-list
cve.org
访问
[kafka-jira] 20210506 [GitHub] [kafka] omkreddy commented on pull request #10641: KAFKA-12752: CVE-2021-28168 upgrade jersey to 2.34 or 3.02 mailing-list
cve.org
访问
[kafka-jira] 20210506 [GitHub] [kafka] omkreddy merged pull request #10636: MINOR: Bump Jersey deps to 2.34 due to CVE-2021-28168 mailing-list
cve.org
访问
[kafka-commits] 20210506 [kafka] branch 2.7 updated: KAFKA-12752: Bump Jersey deps to 2.34 due to CVE-2021-28168 (#10636) mailing-list
cve.org
访问
[kafka-commits] 20210506 [kafka] branch 2.8 updated: KAFKA-12752: Bump Jersey deps to 2.34 due to CVE-2021-28168 (#10636) mailing-list
cve.org
访问
[kafka-jira] 20210506 [jira] [Resolved] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02 mailing-list
cve.org
访问
[kafka-dev] 20210506 [jira] [Resolved] (KAFKA-12752) CVE-2021-28168 upgrade jersey to 2.34 or 3.02 mailing-list
cve.org
访问
[kafka-jira] 20210507 [GitHub] [kafka] dongjinleekr closed pull request #10641: KAFKA-12752: CVE-2021-28168 upgrade jersey to 2.34 or 3.02 mailing-list
cve.org
访问
[kafka-jira] 20210507 [GitHub] [kafka] dongjinleekr commented on pull request #10641: KAFKA-12752: CVE-2021-28168 upgrade jersey to 2.34 or 3.02 mailing-list
cve.org
访问
[kafka-users] 20210617 vulnerabilities mailing-list
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
CVSS评分详情
3.1 (cna)
MEDIUM
6.2
CVSS向量: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
机密性
HIGH
完整性
NONE
可用性
NONE
时间信息
发布时间:
2021-04-22 17:35:14
修改时间:
2024-08-03 21:40:12
创建时间:
2025-11-11 15:36:47
更新时间:
2025-11-11 15:56:41
利用信息
暂无可利用代码信息
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2021-28168 2025-11-11 15:20:54 2025-11-11 07:36:47
NVD nvd_CVE-2021-28168 2025-11-11 14:57:36 2025-11-11 07:45:06
CNNVD cnnvd_CNNVD-202104-1669 2025-11-11 15:10:37 2025-11-11 07:56:41
版本与语言
当前版本: v3
主要语言: EN
支持语言:
EN ZH
安全公告
暂无安全公告信息
变更历史
v3 CNNVD
2025-11-11 15:56:41
vulnerability_type: 未提取 → 其他; cnnvd_id: 未提取 → CNNVD-202104-1669; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 其他
  • cnnvd_id: 未提取 -> CNNVD-202104-1669
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:45:06
data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • data_sources: ['cve'] -> ['cve', 'nvd']