Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.3
CVE-2021-21429: OpenAPI Generator Maven plugin creates insecure temporary files
CVE-2021-21429 · published 5 years ago
Summary
The OpenAPI Generator Maven plug‑in can create temporary files with permissions that allow other users to read or modify them, potentially exposing your code or data. This risk is addressed in version 5.1.0, which uses a safer method for creating those files. Update the plug‑in to version 5.1.0 or later to protect your system.
What to do
- Update openapitools org.openapitools:openapi-generator-maven-plugin to version 5.1.0.
- Update openapi-generator openapi_generator to version 5.1.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | openapitools | org.openapitools:openapi-generator-maven-plugin |
< 5.1.0 Fix: upgrade to 5.1.0
|
| – | openapi-generator | openapi_generator |
< 5.1.0 cpe:2.3:a:openapi-generator:openapi_generator:*:*:*:*:*:*:*:* |
| Maven | openapitools | org.openapitools:openapi-generator-maven-plugin |
< 5.1.0 Fix: upgrade to 5.1.0
|
Original advisory text
Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin
OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using `File.createTempFile` in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. OpenAPI Generator maven plug-in creates insecure temporary files during the process. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.
References
- https://github.com/OpenAPITools/openapi-generator/blob/06ad7a51eff04393203cfa715...
- https://nvd.nist.gov/vuln/detail/CVE-2021-21429
- https://github.com/advisories/GHSA-867q-77cc-98mv
- https://github.com/OpenAPITools/openapi-generator/pull/8795 Patch Third Party Advisory
- https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-867q-... Patch Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
3.3
Low
Type
CWE-377Insecure Temporary File
CWE-378Creation of Temporary File With Insecure Permissions
CWE-379Creation of Temporary File in Directory with Insecure Permissions
CWE-552Files or Directories Accessible to External Parties
Timeline
Published27 Apr 2021
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta