Fess Insecure Temporary File Permissions Vulnerability Allowing Information Disclosure

A vulnerability exists in Fess versions prior to 14.19.2, where the createTempFile() method in the SystemHelper class generates temporary files without setting restrictive permissions. This oversight could lead to unauthorized access to sensitive data in these files by local users. The issue is most significant in shared or multi-user environments, while single-user deployments are less impacted.

Impact

Exploitation of this vulnerability could allow unauthorized local users to access sensitive information from temporary files created by Fess.

Remediation

Users can upgrade to Fess version 14.19.2 or later to address this vulnerability. For those unable to upgrade, it is recommended to restrict local access to the Fess environment to trusted users only.