[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTDo7czqcTM_FJNCckUQ531hLx4qIaVfdXZmLZh5-pCw":3,"g5a-risk:CVE-2021-23331":110},{"success":4,"data":5,"meta":108},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":45,"epssPercentile":25,"epssTimeSeries":46,"severity":47,"affectedProducts":48,"affectedProductsCount":54,"references":55,"referencesCount":66,"weaknesses":67,"weaknessesCount":54,"isActivelyExploited":71,"cisaInfo":25,"otxData":25,"relatedBlogPosts":72,"seoMetadata":73,"configurations":98,"relatedVendorCves":106,"notableEvents":107},"CVE-2021-23331","What is CVE-2021-23331?","This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workaround fix for this issue is to set the system property java.io.tmpdir to a safe directory as remediation. Note: This version of the SDK is end of life and no longer maintained, please upgrade to the latest version.","This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r-...","2021-02-03T18:15:16.43","2022-04-08T13:36:22.387",3.3,"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":25,"CVSSMetricV2":36,"CVSSMetricV40":25},[16,28],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":26,"ImpactScore":27},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":22,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":22,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":22,"ExploitCodeMaturity":25,"RemediationLevel":25,"ReportConfidence":25,"TemporalScore":25,"TemporalSeverity":25,"ConfidentialityRequirement":25,"IntegrityRequirement":25,"AvailabilityRequirement":23,"ModifiedAttackVector":25,"ModifiedAttackComplexity":25,"ModifiedPrivilegesRequired":25,"ModifiedUserInteraction":25,"ModifiedScope":25,"ModifiedConfidentialityImpact":25,"ModifiedIntegrityImpact":25,"ModifiedAvailabilityImpact":25,"EnvironmentalScore":25,"EnvironmentalSeverity":25},"3.1","LOCAL","LOW","NONE","UNCHANGED",null,1.8,1.4,{"Source":29,"Type":30,"CVSSData":31,"ExploitabilityScore":26,"ImpactScore":35},"report@snyk.io","Secondary",{"Version":20,"VectorString":32,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":22,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":22,"IntegrityImpact":22,"AvailabilityImpact":23,"BaseScore":33,"BaseSeverity":34,"ExploitCodeMaturity":25,"RemediationLevel":25,"ReportConfidence":25,"TemporalScore":25,"TemporalSeverity":25,"ConfidentialityRequirement":25,"IntegrityRequirement":25,"AvailabilityRequirement":23,"ModifiedAttackVector":25,"ModifiedAttackComplexity":25,"ModifiedPrivilegesRequired":25,"ModifiedUserInteraction":25,"ModifiedScope":25,"ModifiedConfidentialityImpact":25,"ModifiedIntegrityImpact":25,"ModifiedAvailabilityImpact":25,"EnvironmentalScore":25,"EnvironmentalSeverity":25},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",4.4,"MEDIUM",2.5,[37],{"Source":17,"Type":18,"CVSSData":38,"BaseSeverity":22,"ExploitabilityScore":43,"ImpactScore":44,"ACInsufInfo":25,"ObtainAllPrivilege":25,"ObtainUserPrivilege":25,"ObtainOtherPrivilege":25,"UserInteractionRequired":25},{"Version":39,"VectorString":40,"AccessVector":21,"AccessComplexity":22,"Authentication":23,"ConfidentialityImpact":41,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":42,"BaseSeverity":25,"Exploitability":25,"RemediationLevel":25,"ReportConfidence":25,"TemporalScore":25,"CollateralDamagePotential":25,"TargetDistribution":25,"ConfidentialityRequirement":25,"IntegrityRequirement":25,"AvailabilityRequirement":25,"EnvironmentalScore":25},"2.0","AV:L\u002FAC:L\u002FAu:N\u002FC:P\u002FI:N\u002FA:N","PARTIAL",2.1,3.9,2.9,0.00341,[45,45,45,45,45,45,45],"Low",[49],{"vendor":50,"product":51,"version":52,"criteria":53,"vulnerable":4},"squareup","connect_java_software_development_kit","*","cpe:2.3:a:squareup:connect_java_software_development_kit:*:*:*:*:*:*:*:*",1,[56,61],{"url":57,"source":58,"tags":59},"https:\u002F\u002Fgithub.com\u002Fsquare\u002Fconnect-java-sdk\u002Fblob\u002Fmaster\u002Fsrc\u002Fmain\u002Fjava\u002Fcom\u002Fsquareup\u002Fconnect\u002FApiClient.java%23L613","GitHub",[60],"Broken Link",{"url":62,"source":63,"tags":64},"https:\u002F\u002Fsnyk.io\u002Fvuln\u002FSNYK-JAVA-COMSQUAREUP-1065988","Snyk",[65],"Third Party Advisory",2,[68],{"id":69,"name":69,"description":70},"Unknown","NVD-CWE-noinfo",false,[],{"title":74,"metaDescription":75,"keywords":76,"canonicalUrl":77,"structuredData":78},"What is CVE-2021-23331? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2021-23331, a low severity cyber security vulnerability from 2021. This affects all versions of package com.squareup:connect. T...","CVE-2021-23331, CVE-2021-23331 vulnerability, CVE-2021-23331 security, low severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2021, CVSS score, exploit, patch, remediation, squareup security, connect_java_software_development_kit vulnerability","\u002Fwhat-is\u002Fcve-2021-23331",{"@context":79,"@type":80,"headline":74,"description":75,"datePublished":10,"dateModified":11,"author":81,"publisher":85,"about":89,"mainEntityOfPage":93,"articleSection":96,"keywords":97},"https:\u002F\u002Fschema.org","TechArticle",{"@type":82,"name":83,"url":84},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":82,"name":83,"url":84,"logo":86},{"@type":87,"url":88},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":90,"name":6,"description":91,"additionalType":92},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":94,"@id":95},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2021-23331","Cybersecurity","CVE-2021-23331, CVE-2021-23331 vulnerability, CVE-2021-23331 security, low severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[99],{"Operator":25,"Negate":25,"Nodes":100},[101],{"Operator":102,"Negate":25,"CPEMatch":103},"OR",[104],{"Vulnerable":4,"Criteria":53,"MatchCriteriaID":105,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":25},"ECBAE5DB-BB7E-4FCA-BEAF-F9F4EA32E42F",[],[],{"lastModified":11,"cacheTime":109,"version":39},1792263942519,{"score":111,"band":112,"action":113,"scoredAt":114},14,"Info","Track","2026-10-16T06:50:24.016897+00:00"]