CWE-668
DiscouragedExposure of Resource to Wrong Sphere
Abstraction: Class · Status: Draft
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
1292 vulnerabilities reference this CWE, most recent first.
GHSA-CJQ3-Q65F-328C
Vulnerability from github – Published: 2022-07-07 00:00 – Updated: 2026-07-05 00:31In IOBit Advanced System Care (AscService.exe) 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named pipes, because of that during login the service will try to connect to the attacker which will lead to either escalation of privileges (through token manipulation and ImpersonateNamedPipeClient() ) from ADMIN -> SYSTEM or from Local ADMIN-> Domain ADMIN depending on the user and named pipe that is used.
{
"affected": [],
"aliases": [
"CVE-2022-24139"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-06T13:15:00Z",
"severity": "HIGH"
},
"details": "In IOBit Advanced System Care (AscService.exe) 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService\u0027s named pipes. ASCService first tries to connect before trying to create the named pipes, because of that during login the service will try to connect to the attacker which will lead to either escalation of privileges (through token manipulation and ImpersonateNamedPipeClient() ) from ADMIN -\u003e SYSTEM or from Local ADMIN-\u003e Domain ADMIN depending on the user and named pipe that is used.",
"id": "GHSA-cjq3-q65f-328c",
"modified": "2026-07-05T00:31:33Z",
"published": "2022-07-07T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24139"
},
{
"type": "WEB",
"url": "https://github.com/tomerpeled92/CVE"
},
{
"type": "WEB",
"url": "http://advanced.com"
},
{
"type": "WEB",
"url": "http://iobit.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CM3C-7FFR-R2CR
Vulnerability from github – Published: 2022-10-19 19:00 – Updated: 2022-10-21 19:01The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in the root user's authorized_keys file.
{
"affected": [],
"aliases": [
"CVE-2013-4253"
],
"database_specific": {
"cwe_ids": [
"CWE-377",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-19T18:15:00Z",
"severity": "HIGH"
},
"details": "The deployment script in the unsupported \"OpenShift Extras\" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in the root user\u0027s authorized_keys file.",
"id": "GHSA-cm3c-7ffr-r2cr",
"modified": "2022-10-21T19:01:13Z",
"published": "2022-10-19T19:00:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4253"
},
{
"type": "WEB",
"url": "https://github.com/openshift/openshift-extras/blob/enterprise-2.0/README.md#security-notice"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2014/06/05/19"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CM59-PR5Q-CW85
Vulnerability from github – Published: 2022-07-11 20:59 – Updated: 2022-07-11 20:59spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method.
The vulnerable method is used to create a work directory for embedded web servers such as Tomcat and Jetty. The directory contains configuration files, JSP/class files, etc. If a local attacker got the permission to write in this directory, they could completely take over the application (ie. local privilege escalation).
Impact Location
This vulnerability impacted the following source location:
/**
* Return the absolute temp dir for given web server.
* @param prefix server name
* @return the temp dir for given server.
*/
protected final File createTempDir(String prefix) {
try {
File tempDir = File.createTempFile(prefix + ".", "." + getPort());
tempDir.delete();
tempDir.mkdir();
tempDir.deleteOnExit();
return tempDir;
}
- https://github.com/spring-projects/spring-boot/blob/ce70e7d768977242a8ea6f93188388f273be5851/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/server/AbstractConfigurableWebServerFactory.java#L165-L177
This vulnerability exists because File.mkdir returns false when it fails to create a directory, it does not throw an exception. As such, the following race condition exists:
File tmpDir =File.createTempFile(prefix + ".", "." + getPort()); // Attacker knows the full path of the file that will be generated
// delete the file that was created
tmpDir.delete(); // Attacker sees file is deleted and begins a race to create their own directory before Jetty.
// and make a directory of the same name
// SECURITY VULNERABILITY: Race Condition! - Attacker beats java code and now owns this directory
tmpDir.mkdirs(); // This method returns 'false' because it was unable to create the directory. No exception is thrown.
// Attacker can write any new files to this directory that they wish.
// Attacker can read any files created by this process.
Prerequisites
This vulnerability impacts Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.
Patches
This vulnerability was inadvertently fixed as a part of this patch: https://github.com/spring-projects/spring-boot/commit/667ccdae84822072f9ea1a27ed5c77964c71002d
This vulnerability is patched in versions v2.2.11.RELEASE or later.
Workarounds
Setting the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability for all operating systems.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.2.10.RELEASE"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.boot:spring-boot"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.11.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-27772"
],
"database_specific": {
"cwe_ids": [
"CWE-377",
"CWE-379",
"CWE-668"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-11T20:59:02Z",
"nvd_published_at": "2022-03-30T18:15:00Z",
"severity": "HIGH"
},
"details": "spring-boot versions prior to version `v2.2.11.RELEASE` was vulnerable to temporary directory hijacking. This vulnerability impacted the `org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir` method.\n\nThe vulnerable method is used to create a work directory for embedded web servers such as Tomcat and Jetty. The directory contains configuration files, JSP/class files, etc. If a local attacker got the permission to write in this directory, they could completely take over the application (ie. local privilege escalation).\n\n#### Impact Location\n\nThis vulnerability impacted the following source location:\n\n```java\n\t/**\n\t * Return the absolute temp dir for given web server.\n\t * @param prefix server name\n\t * @return the temp dir for given server.\n\t */\n\tprotected final File createTempDir(String prefix) {\n\t\ttry {\n\t\t\tFile tempDir = File.createTempFile(prefix + \".\", \".\" + getPort());\n\t\t\ttempDir.delete();\n\t\t\ttempDir.mkdir();\n\t\t\ttempDir.deleteOnExit();\n\t\t\treturn tempDir;\n\t\t}\n```\n\\- https://github.com/spring-projects/spring-boot/blob/ce70e7d768977242a8ea6f93188388f273be5851/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/server/AbstractConfigurableWebServerFactory.java#L165-L177\n\nThis vulnerability exists because `File.mkdir` returns `false` when it fails to create a directory, it does not throw an exception. As such, the following race condition exists:\n\n```java\nFile tmpDir =File.createTempFile(prefix + \".\", \".\" + getPort()); // Attacker knows the full path of the file that will be generated\n// delete the file that was created\ntmpDir.delete(); // Attacker sees file is deleted and begins a race to create their own directory before Jetty.\n// and make a directory of the same name\n// SECURITY VULNERABILITY: Race Condition! - Attacker beats java code and now owns this directory\ntmpDir.mkdirs(); // This method returns \u0027false\u0027 because it was unable to create the directory. No exception is thrown.\n// Attacker can write any new files to this directory that they wish.\n// Attacker can read any files created by this process.\n```\n\n### Prerequisites\n\nThis vulnerability impacts Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.\n\n### Patches\n\nThis vulnerability was inadvertently fixed as a part of this patch: https://github.com/spring-projects/spring-boot/commit/667ccdae84822072f9ea1a27ed5c77964c71002d\n\nThis vulnerability is patched in versions `v2.2.11.RELEASE` or later.\n\n### Workarounds\n\nSetting the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability for all operating systems.",
"id": "GHSA-cm59-pr5q-cw85",
"modified": "2022-07-11T20:59:02Z",
"published": "2022-07-11T20:59:02Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-cm59-pr5q-cw85"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27772"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-boot/commit/667ccdae84822072f9ea1a27ed5c77964c71002d"
},
{
"type": "PACKAGE",
"url": "https://github.com/spring-projects/spring-boot"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot"
}
GHSA-CMHM-J62G-4H3R
Vulnerability from github – Published: 2022-06-15 00:00 – Updated: 2022-06-25 00:00An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics.
{
"affected": [],
"aliases": [
"CVE-2022-32559"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-14T17:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics.",
"id": "GHSA-cmhm-j62g-4h3r",
"modified": "2022-06-25T00:00:52Z",
"published": "2022-06-15T00:00:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32559"
},
{
"type": "WEB",
"url": "https://docs.couchbase.com/server/current/release-notes/relnotes.html"
},
{
"type": "WEB",
"url": "https://forums.couchbase.com/tags/security"
},
{
"type": "WEB",
"url": "https://www.couchbase.com/alerts"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CMW2-FM8J-QP55
Vulnerability from github – Published: 2022-03-19 00:00 – Updated: 2022-03-29 00:01This issue was addressed with improved checks. This issue is fixed in iOS 15.4 and iPadOS 15.4. A person with physical access to an iOS device may be able to see sensitive information via keyboard suggestions.
{
"affected": [],
"aliases": [
"CVE-2022-22622"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-18T18:15:00Z",
"severity": "MODERATE"
},
"details": "This issue was addressed with improved checks. This issue is fixed in iOS 15.4 and iPadOS 15.4. A person with physical access to an iOS device may be able to see sensitive information via keyboard suggestions.",
"id": "GHSA-cmw2-fm8j-qp55",
"modified": "2022-03-29T00:01:33Z",
"published": "2022-03-19T00:00:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22622"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213182"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CP7M-QCCX-QC2G
Vulnerability from github – Published: 2022-05-24 17:02 – Updated: 2024-03-21 03:33PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/random_token/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchema_ListDatabases request while using a low-privilege account. (This can perform actions and retrieve data that only an administrator should have access to.)
{
"affected": [],
"aliases": [
"CVE-2019-16387"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-11-26T18:15:00Z",
"severity": "MODERATE"
},
"details": "PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/random_token/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchema_ListDatabases request while using a low-privilege account. (This can perform actions and retrieve data that only an administrator should have access to.)",
"id": "GHSA-cp7m-qccx-qc2g",
"modified": "2024-03-21T03:33:47Z",
"published": "2022-05-24T17:02:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16387"
},
{
"type": "WEB",
"url": "https://blog.cybercastrum.com/2019/11/25/cve-2019-16387"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CPMG-9XQ8-3934
Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2025-10-22 00:32Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2021-35211"
],
"database_specific": {
"cwe_ids": [
"CWE-668",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-14T21:15:00Z",
"severity": "CRITICAL"
},
"details": "Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.",
"id": "GHSA-cpmg-9xq8-3934",
"modified": "2025-10-22T00:32:18Z",
"published": "2022-05-24T19:07:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35211"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35211"
},
{
"type": "WEB",
"url": "https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit"
},
{
"type": "WEB",
"url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CPMQ-C39J-PM97
Vulnerability from github – Published: 2023-09-12 18:30 – Updated: 2024-04-04 07:38Windows TCP/IP Information Disclosure Vulnerability
{
"affected": [],
"aliases": [
"CVE-2023-38160"
],
"database_specific": {
"cwe_ids": [
"CWE-416",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-12T17:15:21Z",
"severity": "MODERATE"
},
"details": "Windows TCP/IP Information Disclosure Vulnerability",
"id": "GHSA-cpmq-c39j-pm97",
"modified": "2024-04-04T07:38:14Z",
"published": "2023-09-12T18:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38160"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38160"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CQHR-XWVR-X8F9
Vulnerability from github – Published: 2022-05-24 19:13 – Updated: 2022-05-24 19:13Adobe Genuine Services version 7.1 (and earlier) is affected by an Insecure file permission vulnerability during installation process. A local authenticated attacker could leverage this vulnerability to achieve privilege escalation in the context of the current user.
{
"affected": [],
"aliases": [
"CVE-2021-28568"
],
"database_specific": {
"cwe_ids": [
"CWE-379",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-08T17:15:00Z",
"severity": "MODERATE"
},
"details": "Adobe Genuine Services version 7.1 (and earlier) is affected by an Insecure file permission vulnerability during installation process. A local authenticated attacker could leverage this vulnerability to achieve privilege escalation in the context of the current user.",
"id": "GHSA-cqhr-xwvr-x8f9",
"modified": "2022-05-24T19:13:21Z",
"published": "2022-05-24T19:13:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28568"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/integrity_service/apsb21-27.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CQVG-FWRM-3XXF
Vulnerability from github – Published: 2022-08-23 00:00 – Updated: 2022-08-27 00:00Tabit - Excessive data exposure. Another endpoint mapped by the tiny url, was one for reservation cancellation, containing the MongoDB ID of the reservation, and organization. This can be used to query the http://tgm-api.tabit.cloud/rsv/management/{reservationId}?organization={orgId} API which returns a lot of data regarding the reservation (OWASP: API3): Name, mail, phone number, the number of visits of the user to this specific restaurant, the money he spent there, the money he spent on alcohol, whether he left a deposit etc. This information can easily be used for a phishing attack.
{
"affected": [],
"aliases": [
"CVE-2022-34775"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-22T15:15:00Z",
"severity": "HIGH"
},
"details": "Tabit - Excessive data exposure. Another endpoint mapped by the tiny url, was one for reservation cancellation, containing the MongoDB ID of the reservation, and organization. This can be used to query the http://tgm-api.tabit.cloud/rsv/management/{reservationId}?organization={orgId} API which returns a lot of data regarding the reservation (OWASP: API3): Name, mail, phone number, the number of visits of the user to this specific restaurant, the money he spent there, the money he spent on alcohol, whether he left a deposit etc. This information can easily be used for a phishing attack.",
"id": "GHSA-cqvg-fwrm-3xxf",
"modified": "2022-08-27T00:00:53Z",
"published": "2022-08-23T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34775"
},
{
"type": "WEB",
"url": "https://www.gov.il/en/departments/faq/cve_advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.