CVE-2020-15250
MediumCVSS 4.4Exploitation Probability (EPSS)
High risk76th percentile - higher than 76% of all known CVEs
Summary
In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix-like systems, the system's temporary directory is shared between all users, and files and directories written there are by default readable by other users on the same system. This vulnerability impacts you if JUnit tests write sensitive information, like API keys or passwords, into the temporary folder and execute in an environment with other untrusted users.
Risk Assessment
If JUnit tests write sensitive data (e.g., API keys, passwords) into the shared temporary folder, other users on the system may read it. The risk mainly affects CI/CD environments and servers shared by multiple users.
Recommendation
Upgrade JUnit4 to version 4.13.1 (for Java 1.7+). For Java 1.6 and lower no patch is available — set the java.io.tmpdir system environment variable to a directory exclusively owned by the executing user.
Related vulnerabilities
- CVE-2026-82418Critical
IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 contain a use-after-free vulnerability that could allow a remote attacker to execute arbitrary code.
- CVE-2026-122013Critical
A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1 in an unknown functionality of /usr/bin/webmgnt within the Multipart Parser component. Manipulating the filename argument results in path traversal, the attack can be initiated remotely, the exploit is public, and the vendor did not respond.
- CVE-2025-71457Critical
vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.
- CVE-2026-121933Critical
A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the Setup Wizard component. Manipulating the wizard_router_pwd argument can lead to missing authentication. The attack may be launched remotely, and the exploit has been published and may be used.
- CVE-2026-113373Critical
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account and then receives a new session with the roles of that account.
- CVE-2026-122120Critical
In Yealink Plug-in Softwares before 2.35.219.0, an unauthorized file write vulnerability exists under specific scenarios. It may be exploited by attackers to achieve remote code execution.
- CVE-2026-121932Critical
In Linksys E5350 1.0.00.037, the system function in /wizard/apply.cgi mishandles the ping_ip/traceroute_ip argument, resulting in OS command injection. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-121931Critical
In Linksys WRT54GL 4.30.18, the system function in apply.cgi (Traceroute Diagnostic component) mishandles the traceroute_ip argument, enabling OS command injection. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-121930Critical
In Linksys WRT54GL 4.30.18, the system function in apply.cgi (Ping Diagnostic component) mishandles the ping_ip argument, causing OS command injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-113780Critical
In ESP-IDF (Espressif IoT Development Framework) from 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary.
Original NVD description (English source)
In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS