CVE-2023-33695: Incorrect Permission Assignment for Critical Resource

June 13, 2023 (updated June 21, 2023)

Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java.

References

github.com/advisories/GHSA-7mcw-xmx3-7p8m
github.com/dromara/hutool/commit/c33550f703f5d1d7dd71ad2992d79a5e5532ce2c
github.com/dromara/hutool/issues/3103
nvd.nist.gov/vuln/detail/CVE-2023-33695

Code Behaviors & Features

Detect and mitigate CVE-2023-33695 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →