CVE-2024-4030
highpriority · track · 0OT risk · elevatedEPSS 0.003 · 22 %ileDEEUNLRUUSEPSS · scored 2026-10-23
On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions. If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user. This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (15)
Products and version ranges known to be affected.
- communications_unified_assuranceall versionsncsc_nlNLcpe:2.3:a:oracle:communications_unified_assurance:6.0.0-6.0.5:*:*:*:*:*:*:*
- peoplesoft_enterprise_peopletoolsall versionsncsc_nlNLcpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.60:*:*:*:*:*:*:*
- peoplesoft_enterprise_peopletoolsall versionsncsc_nlNLcpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*
advisories (6)
Vendor and ecosystem advisories describing this.
- NCSC-2025-0020Kwetsbaarheden verholpen in Oracle Database productenNL2025-01-22csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in diverse database producten en subsystemen, zoals de Core Database, Graal, Application Express, GoldenGate en REST data.
- NCSC-2025-0021Kwetsbaarheden verholpen in Oracle CommunicationsNL2025-01-22csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in zijn Communicatieproducten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Network Function en Oracle Communications Order and Service Management.
- NCSC-2025-0023Kwetsbaarheden verholpen in Oracle PeopleSoftNL2025-01-22csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in Oracle PeopleSoft, specifiek in de versies 8.60, 8.61 en 9.2.
- WID-SEC-W-2025-2448NetApp ActiveIQ Unified Manager: Schwachstelle ermöglicht Manipulation von Dateien und Offenlegung von InformationenDeutsch2025-10-29csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in NetApp ActiveIQ Unified Manager ausnutzen, um Dateien zu manipulieren, und um Informationen offenzulegen.
- BIT-python-2024-40302024-05-14vendor · osvUS
On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions.If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user.This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.
- PSF-2024-32024-05-07vendor · osvUS
On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions. If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user. This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.
also known as (6)
Other names and identifiers for this entity.
- CNNVD-202405-1639cnnvd
- EUVD-2024-32595enisa_euvd
- BDU:2024-08617fstec_bdu
- GHSA-2w87-6hh6-mqrjenisa_euvd
- BIT-python-2024-4030osv
- PSF-2024-3osv
sources
Which sources assert this record, and when.
references (47)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-4030/cnnvd
- https://github.com/python/cpython/commit/35c799d79177b962ddace2fa068101465570a29acnnvd
- https://github.com/python/cpython/commit/5130731c9e779b97d00a24f54cdce73ce9975dfdcnnvd
- https://github.com/python/cpython/commit/66f8bb76a15e64a1bb7688b177ed29e26230fdeecnnvd
- https://github.com/python/cpython/commit/6d0850c4c8188035643586ab4d8ec2468abd699ecnnvd
- https://github.com/python/cpython/commit/81939dad77001556c527485d31a2d0f4a759033ecnnvd
- https://github.com/python/cpython/commit/8ed546679524140d8282175411fd141fe7df070dcnnvd
- https://github.com/python/cpython/commit/91e3669e01245185569d09e9e6e11641282971eecnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan