LiveActive security incident?Get immediate response
CVE Record

CVE-2021-23331: Insecure Temporary File

This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workaround fix for this issue is to set the system property java.io.tmpdir to a safe directory as remediation. Note: This version of the SDK is end of life and no longer maintained, please upgrade to the latest version.

MediumCVSS 4.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Applications using the end-of-life Square com.squareup:connect Java SDK can create downloaded temporary files readable by other local users on Unix-like systems. The main business risk is unintended exposure of downloaded data on shared hosts. This is not described as remotely exploitable or actively exploited in the provided sources.

Executive priority

Treat this as a moderate-priority dependency and configuration issue. It is less urgent than internet-facing remote code execution, but shared infrastructure or sensitive downloaded data increases business impact and should drive timely remediation.

Technical view

The SDK method prepareDownloadFile creates temporary files with -rw-r--r-- permissions. downloadFileFromResponse can therefore leave downloaded content readable by other local users in a shared system temp directory. CVSS is 4.4, local attack vector, low confidentiality and integrity impact, and no availability impact.

Likely exposure

Exposure is most likely in Java services using com.squareup:connect on Unix-like multi-user systems where java.io.tmpdir points to a shared temporary directory. Single-user hosts or containers with private temp directories reduce practical exposure, but dependency use should still be reviewed.

Exploitation context

The CVE is not in KEV, and the provided sources do not claim active exploitation. The attacker model is local: a user with access to the same system may be able to read temporary downloaded files created by the SDK.

Researcher notes

The source bundle identifies all versions of com.squareup:connect as affected, but does not provide a fixed version for that package. It names a workaround and notes the SDK is end of life. No CWE is supplied, and exploit evidence is limited to the local exposure scenario.

Mitigation direction

  • Identify and prioritize systems using com.squareup:connect.
  • Upgrade from the end-of-life SDK to a maintained Square SDK.
  • Set java.io.tmpdir to a private, trusted directory as the documented workaround.
  • Review vendor guidance before relying on any additional remediation.
  • Restrict local user access on affected shared hosts where feasible.

Validation and detection

  • Confirm whether applications depend on com.squareup:connect.
  • Check whether affected workloads run on Unix-like shared systems.
  • Review java.io.tmpdir configuration for a private temp path.
  • Assess whether downloaded files may contain sensitive business or customer data.
  • Verify remediation by confirming temporary downloads are not broadly readable.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-23331 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:W/RC:C

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.4CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:W/RC:C1.82.5Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

4.4Medium
CVSS 3.1 vector shape for CVE-2021-23331Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:W/RC:C

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/acom.squareup:connect0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.