CVE-2018-25068 — devent globalpom-utils FileResourceManagerProvider.java createTmpDir temp file

Back Back to CVE browser

CRITICAL

devent globalpom-utils FileResourceManagerProvider.java createTmpDir temp file

Published Jan 6, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 0.81%

Description

A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical. This vulnerability affects the function createTmpDir of the file globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java. The manipulation leads to insecure temporary file. The attack can be initiated remotely. Upgrading to version 4.5.1 is able to address this issue. The patch is identified as 77a820bac2f68e662ce261ecb050c643bd7ee560. It is recommended to upgrade the affected component. VDB-217570 is the identifier assigned to this vulnerability.

Affected products

Vendor Devent Product Globalpom-Utils Default
n/a
- Version
  4.0
  Status
  affected
  Constraints
  -
- Version
  4.1
  Status
  affected
  Constraints
  -
- Version
  4.2
  Status
  affected
  Constraints
  -
- Version
  4.3
  Status
  affected
  Constraints
  -
- Version
  4.4
  Status
  affected
  Constraints
  -
- Version
  4.5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Devent

Globalpom-Utils

n/a

Version	Status	Constraints
4.0	affected	-
4.1	affected	-
4.2	affected	-
4.3	affected	-
4.4	affected	-
4.5	affected	-

Remediation

No remediation recorded yet.

Metrics

0.81% 0.00807

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00807

Score over time

2023–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (12 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.81% (0.00807)	55.25th	v5 (v2026.06.15)
Jun 15, 2026	0.81% (0.00807)	51.85th	v5 (v2026.06.15)
Mar 17, 2025	0.05% (0.00048)	12.08th	v4 (v2025.03.14)
Dec 12, 2024	0.20% (0.00198)	58.64th	v3 (v2023.03.01)
Jun 18, 2024	0.17% (0.00166)	53.39th	v3 (v2023.03.01)
Feb 8, 2024	0.15% (0.00155)	50.50th	v3 (v2023.03.01)
Jan 13, 2024	0.13% (0.00130)	47.68th	v3 (v2023.03.01)
Dec 7, 2023	0.07% (0.00074)	30.79th	v3 (v2023.03.01)
Mar 7, 2023	0.06% (0.00063)	24.84th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Jan 13, 2023	1.02% (0.01018)	39.90th	v2 (v2022.01.01)
Jan 7, 2023	0.95% (0.00950)	31.55th	v2 (v2022.01.01)

Weaknesses (2)

CWE-377

CWE-668

References (6)

https://github.com/advisories/GHSA-jjvp-wfp8-rv69
Advisory
https://github.com/devent/globalpom-utils/commit/77a820bac2f68e662ce261ecb050c643bd7ee560
patch
https://github.com/devent/globalpom-utils/releases/tag/globalpomutils-4.5.1
patchRelease Notes
https://nvd.nist.gov/vuln/detail/CVE-2018-25068
https://vuldb.com/?ctiid.217570
signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.217570
vdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-jjvp-wfp8-rv69		Advisory
https://github.com/devent/globalpom-utils/commit/77a820bac2f68e662ce261ecb050c643bd7ee560		patch
https://github.com/devent/globalpom-utils/releases/tag/globalpomutils-4.5.1		patchRelease Notes
https://nvd.nist.gov/vuln/detail/CVE-2018-25068
https://vuldb.com/?ctiid.217570		signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.217570		vdb-entrytechnical-descriptionThird Party Advisory