CWE-378
Creation of Temporary File With Insecure Permissions
AI Translation Available
Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
Status
draft
Abstraction
base
Likelihood
high
Affected Platforms
Technical Details
AI Translation
Common Consequences
confidentiality
authorization
other
integrity
Impacts
read application data
other
Detection Methods
automated static analysis
Potential Mitigations
Phases:
requirements
implementation
Descriptions:
•
Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.
•
Randomize temporary file names. This can also be achieved by using a safe temp-file function. This will ensure that temporary files will not be created in predictable places.
•
Ensure that you use proper file permissions. This can be achieved by using a safe temp file function. Temporary files should be writable and readable only by the process that owns the file.