Back
CVE-2023-2976
Use of temporary directory for file creation in `FileBackedOutputStream` in Guava
Medium5.5EPSS 0.25%
- Published
- Updated
- Reserved
- Assigned by
Description
Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GoogleCNA (assigner) | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CISA-ADPADP (enrichment) | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Modified | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.25% · top 84% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Weakness
- Creation of Temporary File With Insecure Permissions
- CWE-552 Files or Directories Accessible to External Parties (opens in a new tab)All about CWE-552 and its CVEs
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavencom.google.guava:guavaGHSA-7g45-4rm6-3mm3 (opens in a new tab)
References (4)
- https://github.com/google/guava/issues/2575 (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20230818-0008/ (opens in a new tab)x_transferred
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01006.html (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20241108-0002/ (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-7g45-4rm6-3mm3 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-2976)Record last updated .