CWE-379
Creation of Temporary File in Directory with Insecure Permissions
The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
Mitigation
Phase: Requirements
Description:
- Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.
Mitigation
Phase: Implementation
Description:
- Try to store sensitive tempfiles in a directory which is not world readable -- i.e., per-user directories.
Mitigation
Phase: Implementation
Description:
- Avoid using vulnerable temp file functions.
No CAPEC attack patterns related to this CWE.