CVE-2024-23454
Apache Hadoop: Temporary File Local Information Disclosure
- State
- Published
- Severity
- 6.2 Medium
- Published
- Sep 25, 2024
- Updated
- Sep 5, 2025
- Reserved
- Jan 17, 2024
Description
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.2 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-378 Creation of Temporary File With Insecure Permissions
Affected Products
| Product | Versions |
|---|---|
Apache HadoopApache Software Foundation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.