CWE-378—Creation of Temporary File With Insecure Permissions
PUBLISHEDweakness recordHigh
released 2006-07-19 · last modified 2025-12-11
Metadata
- CWE ID：
- CWE-378
- 摘要：
- Base
- 结构：
- Simple
- 状态：
- Draft
- 发布日期：
- 2006-07-19
- 更新日期：
- 2025-12-11
名称
Creation of Temporary File With Insecure Permissions
描述
Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
常见后果
- 范围：
- Confidentiality
- 影响：
- Read Application Data
- 注释：
- If the temporary file can be read by the attacker, sensitive information may be in that file which could be revealed.
- 范围：
- Authorization, Other
- 影响：
- Other
- 注释：
- If that file can be written to by the attacker, the file might be moved into a place to which the attacker does not have access. This will allow the attacker to gain selective resource access-control privileges.
- 范围：
- Integrity, Other
- 影响：
- Other
- 注释：
- Depending on the data stored in the temporary file, there is the potential for an attacker to gain an additional input vector which is trusted as non-malicious. It may be possible to make arbitrary changes to data structures, user information, or even process ownership.