Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2020-15250— Information disclosure in JUnit4

Quick assessment

Affected
junit-team junit4
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Junit是个人开发者的一个开放源代码的Java测试框架。 JUnit4 4.13.1之前版本存在信息泄露漏洞，该漏洞源于测试规则TemporaryFolder包含一个本地信息泄露漏洞。在类似Unix的系统中，系统的临时目录在该系统上的所有用户之间共享。因此，在将文件和目录写入此目录时，默认情况下，相同系统上的其他用户都可以读取它们。此漏洞不允许其他用户覆盖这些目录或文件的内容。这纯粹是一个信息披露的漏洞。如果JUnit测试编写了敏感信息，这个漏洞就会对您造成影响。

CVSS 4.4 · Medium EPSS 1.70% · P76

Possible ATT&CK Techniques 1 AI

T1114 · Email Collection
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2020-15250

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Information disclosure in JUnit4
Source: CVE Program / CVE List V5
Vulnerability Description
In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Junit 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Junit是个人开发者的一个开放源代码的Java测试框架。 JUnit4 4.13.1之前版本存在信息泄露漏洞，该漏洞源于测试规则TemporaryFolder包含一个本地信息泄露漏洞。在类似Unix的系统中，系统的临时目录在该系统上的所有用户之间共享。因此，在将文件和目录写入此目录时，默认情况下，相同系统上的其他用户都可以读取它们。此漏洞不允许其他用户覆盖这些目录或文件的内容。这纯粹是一个信息披露的漏洞。如果JUnit测试编写了敏感信息，这个漏洞就会对您造成影响。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
junit-team junit4 < 4.13.1 -

II. Public POCs for CVE-2020-15250

# POC Description Source Link Shenlong Link
1 None https://github.com/andikahilmy/CVE-2020-15250-junit4-vulnerable POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-15250

请登录查看更多情报信息。

Patches & Fixes for CVE-2020-15250 (1)

Vendor Advisories for CVE-2020-15250 (2)

Mailing List Discussions for CVE-2020-15250 (33)

Other References for CVE-2020-15250 (3)

IV. Related Vulnerabilities

Same vendor: junit-team
Same weakness: CWE-200

V. Comments for CVE-2020-15250

No comments yet

Leave a comment