Incorrect Default Permissions Affecting thingsboard package, versions <3.7-r1
Threat Intelligence
EPSS
0.13% (49th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-CHAINGUARDLATEST-THINGSBOARD-7924784
- published 8 Sep 2024
- disclosed 3 Feb 2021
Introduced: 3 Feb 2021
CVE-2020-29582 Open this link in a new tabHow to fix?
Upgrade Chainguard thingsboard to version 3.7-r1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream thingsboard package and not the thingsboard package as distributed by Chainguard.
See How to fix? for Chainguard relevant fixed versions and status.
In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.
References
- https://blog.jetbrains.com
- https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/
- https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E
CVSS Scores
version 3.1