CVE-2023-33695 Insecure Temporary File in HuTool

What is CVE-2023-33695?

CVE-2023-33695 is a high-severity vulnerability in n/a, published on 13 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java.

Weakness: CWE-732

Which versions are affected by CVE-2023-33695?

2 open source packages ship an affected version, including cn.hutool:hutool-core. It affects 1 product.

Products include Hutool Hutool.

How do I fix CVE-2023-33695?

Upgrade cn.hutool:hutool-core to 5.8.19 or later.

Is CVE-2023-33695 being exploited?

There is no known exploitation of CVE-2023-33695 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2023-42276 hutool Buffer Overflow vulnerability Critical 9.8
• CVE-2023-42277 hutool Buffer Overflow vulnerability Critical 9.8
• CVE-2023-24162 Dromara Hutool Deserialization of Untrusted Data vulnerability Critical 9.8
• CVE-2023-24163 Dromara hutool vulnerable to SQL Injection Critical 9.8
• CVE-2022-22885 Improper Certificate Validation in Hutool Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7mcw-xmx3-7p8m.