CVE-2020-8908
lowA temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a tempor…
Vendor / product: Google — guava
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
CVSS
3.3
3.3 (CVSS v3.1)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2020-12-10 23:15
Modified: 2026-11-02 18:18
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-11-03 07:33 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
google / guava <32.0.0
quarkus / quarkus <1.11.4
oracle / commerce_guided_search 11.3.2
oracle / communications_cloud_native_core_network_slice_selection_function 1.2.1
oracle / communications_pricing_design_center 12.0.0.4.0, 12.0.0.5.0
oracle / data_integrator 12.2.1.3.0, 12.2.1.4.0
oracle / nosql_database <20.3
oracle / peoplesoft_enterprise_peopletools 8.57, 8.58, 8.59
oracle / retail_customer_management_and_segmentation_foundation ≥16.0 ≤19.0
oracle / weblogic_server 14.1.1.0.0
oracle / communications_cloud_native_core_network_repository_function 1.14.0
oracle / primavera_unifier ≥17.7 ≤17.12, 18.8, 19.12, 20.12, 21.12
netapp / active_iq_unified_manager all versions
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/google/guava/commit/fec0dbc4634006a6162cfd4d0d09c962073ddf40
Patch / mitigation: https://github.com/google/guava/issues/4011
Patch / mitigation: https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-1015415
Patch / mitigation: https://www.oracle.com//security-alerts/cpujul2021.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuApr2021.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuapr2022.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuoct2021.html
Patch / mitigation: https://github.com/google/guava/commit/fec0dbc4634006a6162cfd4d0d09c962073ddf40
Patch / mitigation: https://github.com/google/guava/issues/4011
Patch / mitigation: https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-1015415
References
- https://github.com/google/guava/commit/fec0dbc4634006a6162cfd4d0d09c962073ddf40 cve-coordination@google.com
- https://github.com/google/guava/issues/4011 cve-coordination@google.com
- https://lists.apache.org/thread.html/r007add131977f4f576c232b25e024249a3d16f66aad14a4b5281... cve-coordination@google.com
- https://lists.apache.org/thread.html/r07ed3e4417ad043a27bee7bb33322e9bfc7d7e6d1719b8e3dfd9... cve-coordination@google.com
- https://lists.apache.org/thread.html/r161b87f8037bbaff400194a63cd2016c9a69f5949f06dcc79bee... cve-coordination@google.com
- https://lists.apache.org/thread.html/r215b3d50f56faeb2f9383505f3e62faa9f549bb23e8a9848b78a... cve-coordination@google.com
- https://lists.apache.org/thread.html/r294be9d31c0312d2c0837087204b5d4bf49d0552890e6eec716f... cve-coordination@google.com
- https://lists.apache.org/thread.html/r2fe45d96eea8434b91592ca08109118f6308d60f6d0e21d52438... cve-coordination@google.com
- https://lists.apache.org/thread.html/r3c3b33ee5bef0c67391d27a97cbfd89d44f328cf072b601b58d4... cve-coordination@google.com
- https://lists.apache.org/thread.html/r3dd8881de891598d622227e9840dd7c2ef1d08abbb49e9690c7a... cve-coordination@google.com
- https://lists.apache.org/thread.html/r4776f62dfae4a0006658542f43034a7fc199350e35a66d4e1816... cve-coordination@google.com
- https://lists.apache.org/thread.html/r49549a8322f62cd3acfa4490d25bfba0be04f3f9ff4d14fe3619... cve-coordination@google.com
- https://lists.apache.org/thread.html/r58a8775205ab1839dba43054b09a9ab3b25b423a4170b2413c40... cve-coordination@google.com
- https://lists.apache.org/thread.html/r5b3d93dfdfb7708e796e8762ab40edbde8ff8add48aba53e5ea2... cve-coordination@google.com
- https://lists.apache.org/thread.html/r5d61b98ceb7bba939a651de5900dbd67be3817db6bfcc41c6e04... cve-coordination@google.com
- https://lists.apache.org/thread.html/r6874dfe26eefc41b7c9a5e4a0487846fc4accf8c78ff948b24a1... cve-coordination@google.com
- https://lists.apache.org/thread.html/r68d86f4b06c808204f62bcb254fcb5b0432528ee8d37a07ef4bc... cve-coordination@google.com
- https://lists.apache.org/thread.html/r79e47ed555bdb1180e528420a7a2bb898541367a29a3bc6bbf0b... cve-coordination@google.com
- https://lists.apache.org/thread.html/r7b0e81d8367264d6cad98766a469d64d11248eb654417809bfda... cve-coordination@google.com
- https://lists.apache.org/thread.html/r841c5e14e1b55281523ebcde661ece00b38a0569e00ef5e12bd5... cve-coordination@google.com
- https://lists.apache.org/thread.html/ra7ab308481ee729f998691e8e3e02e93b1dedfc98f6b1cd3d869... cve-coordination@google.com
- https://lists.apache.org/thread.html/rb2364f4cf4d274eab5a7ecfaf64bf575cedf8b0173551997c749... cve-coordination@google.com
- https://lists.apache.org/thread.html/rb8c0f1b7589864396690fe42a91a71dea9412e86eec66dc85bba... cve-coordination@google.com
- https://lists.apache.org/thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e0... cve-coordination@google.com
- https://lists.apache.org/thread.html/rc2dbc4633a6eea1fcbce6831876cfa17b73759a98c65326d1896... cve-coordination@google.com
Data sources
NVD CVE API 2.0 — fetched 2026-11-03 07:33 UTC · record ↗