CVE-2021-21428

CRITICAL

Openapi-generator Openapi Generator < 5.1.0 - Exposure to Wrong Actor

Title source: rule

Description

Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.

References (2)

[Patch, Third Party Advisory] https://github.com/OpenAPITools/openapi-generator/pull/8788

[Exploit, Third Party Advisory] https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-23x4-m842-fmwf

Scores

CVSS v3 9.3

EPSS 0.0005

EPSS Percentile 15.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Classification

CWE

CWE-269 CWE-668

Status published

Affected Products (2)

openapi-generator/openapi_generator < 5.1.0

org.openapitools/openapi-generator-online < 5.1.0Maven

Timeline

Published May 10, 2021

Tracked Since Feb 18, 2026