What is the CVSS score of CVE-2022-24823?

CVE-2022-24823 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 1.0%.

Is there a public PoC exploit available for CVE-2022-24823?

Yes, a public proof-of-concept exploit is available for CVE-2022-24823. Prioritise patching immediately. EPSS: 1.0%.

Is there a patch available for CVE-2022-24823?

Yes, a patch is available for CVE-2022-24823. Update the affected software to the latest version immediately.

Java CVE-2022-24823

MEDIUM

Creation of Temporary File With Insecure Permissions (CWE-378)

2022-05-06 security-advisories@github.com

Java Microsoft Information Disclosure Netty Financial Services Crime And Compliance Management Studio Active Iq Unified Manager Oncommand Workflow Automation Snapcenter

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

May 06, 2022 - 12:15 nvd

MEDIUM 5.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6,052 maven packages depend on io.netty:netty-codec-http (213 direct, 5,915 indirect)

Ecosystem-wide dependent count for version 4.1.77.Final.

DescriptionNVD

Netty is an open-source, asynchronous event-driven network application framework. The package io.netty:netty-codec-http prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own java.io.tmpdir when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.

AnalysisAI

Netty is an open-source, asynchronous event-driven network application framework. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-378. Netty is an open-source, asynchronous event-driven network application framework. The package io.netty:netty-codec-http prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own java.io.tmpdir when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user. Affected products include: Netty, Oracle Financial Services Crime And Compliance Management Studio, Netapp Active Iq Unified Manager, Netapp Oncommand Workflow Automation, Netapp Snapcenter. Version information: version 4.1.77..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.