CVE-2022-24913

Published: Jan 12, 2023Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.

Affected (1)

Products: Java Merge Sort Project: Java Merge Sort

Java Merge Sort Project

1 product

Java Merge Sort

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Java Merge Sort Project Java Merge Sort	Before 1.1.0

Related CWEs

Insecure Temporary File

Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

References (6)

https://github.com/cowtowncoder/java-merge-sort/commit/450fdee70b5f181c2afc5d817f293efa1a543902

Source: report@snyk.io

PatchThird Party Advisory

https://github.com/cowtowncoder/java-merge-sort/pull/21

Source: report@snyk.io

PatchThird Party Advisory

https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLUTIL-3227926

Source: report@snyk.io

Third Party Advisory

https://github.com/cowtowncoder/java-merge-sort/commit/450fdee70b5f181c2afc5d817f293efa1a543902

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/cowtowncoder/java-merge-sort/pull/21

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLUTIL-3227926

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.