CVE-2024-23454
Apache Hadoop: Temporary File Local Information Disclosure
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Hadoop: Temporary File Local Information Disclosure
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.
- Record
CVE-2024-23454- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-378
- Updated
- 2026-11-02
EUVDEUVD-2024-2780
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.
- Record
EUVD-2024-2780- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f5fw-25gw-5m92
Apache Hadoop: Temporary File Local Information Disclosure
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.
- Record
GHSA-f5fw-25gw-5m92- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-269, CWE-378
- Updated
- 2026-11-02
NVD
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.
- Record
CVE-2024-23454- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-378
- Updated
- 2026-11-02
OSV
Apache Hadoop: Temporary File Local Information Disclosure
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.
- Record
CVE-2024-23454- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-378
- Updated
- 2026-11-02
OSVGHSA-f5fw-25gw-5m92
Apache Hadoop: Temporary File Local Information Disclosure
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.
- Record
GHSA-f5fw-25gw-5m92- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-269, CWE-378
- Updated
- 2026-11-02
Show 8 moreShow less
OSVOESA-2024-2347
hadoop-3.1 security update
Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. It is designed to scale up from single servers to thousands of machines, each offering local computation and storage.
Security Fix(es):
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.(CVE-2024-23454)
- Record
OESA-2024-2347- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2024-2348
hadoop-3.1 security update
Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. It is designed to scale up from single servers to thousands of machines, each offering local computation and storage.
Security Fix(es):
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.(CVE-2024-23454)
- Record
OESA-2024-2348- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2024-2349
hadoop security update
Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. It is designed to scale up from single servers to thousands of machines, each offering local computation and storage.
Security Fix(es):
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.(CVE-2024-23454)
- Record
OESA-2024-2349- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2024-2350
hadoop security update
Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. It is designed to scale up from single servers to thousands of machines, each offering local computation and storage.
Security Fix(es):
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.(CVE-2024-23454)
- Record
OESA-2024-2350- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2024-2351
hadoop security update
Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. It is designed to scale up from single servers to thousands of machines, each offering local computation and storage.
Security Fix(es):
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.(CVE-2024-23454)
- Record
OESA-2024-2351- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2025-1038
hadoop security update
Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. It is designed to scale up from single servers to thousands of machines, each offering local computation and storage.
Security Fix(es):
Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.(CVE-2024-23454)
- Record
OESA-2025-1038- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2025-1752019359 No score
TuxCare security update for org.apache.hadoop:hadoop-common (1 CVE)
TuxCare rebuilt org.apache.hadoop:hadoop-common to address 1 CVE. Fixed in 2.7.1.tuxcare.1.
- Record
CLSA-2025-1752019359- Updated
- 2026-11-02
OSVCLSA-2025-1762474004 No score
TuxCare security update for org.apache.hadoop:hadoop-common (1 CVE)
TuxCare rebuilt org.apache.hadoop:hadoop-common to address 1 CVE. Fixed in 2.7.3.tuxcare.1.
- Record
CLSA-2025-1762474004- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.hadoop:hadoop-commonMaven |
before 3.4.0 | 3.4.0 |
org.apache.hadoop:hadoop-commonTuxCare:Maven |
2.7.1 up to 2.7.1.tuxcare.1 | 2.7.1.tuxcare.1 |
org.apache.hadoop:hadoop-commonTuxCare:Maven |
2.7.3 up to 2.7.3.tuxcare.1 | 2.7.3.tuxcare.1 |
org.apache.hadoop:hadoop-commonMaven |
before 3.4.0, plus listed versions 0.22.00.23.10.23.100.23.110.23.3 Show 45 moreShow less0.23.40.23.50.23.60.23.70.23.80.23.92.0.0-alpha2.0.1-alpha2.0.2-alpha2.0.3-alpha2.0.4-alpha2.0.5-alpha2.0.6-alpha2.1.0-beta2.1.1-beta2.10.02.10.12.10.22.2.02.3.02.4.02.4.12.5.02.5.12.5.22.6.02.6.12.6.22.6.32.6.42.6.52.7.02.7.12.7.22.7.32.7.42.7.52.7.62.7.72.8.02.8.12.8.22.8.32.8.42.8.5 |
3.4.0 |
hadoop-3.1openEuler:20.03-LTS-SP4 |
before 3.1.4-11.oe2003sp4 | 3.1.4-11.oe2003sp4 |
hadoop-3.1openEuler:22.03-LTS-SP1 |
before 3.1.4-5.oe2203sp1 | 3.1.4-5.oe2203sp1 |
hadoopopenEuler:22.03-LTS-SP3 |
before 3.3.6-4.oe2203sp3 | 3.3.6-4.oe2203sp3 |
hadoopopenEuler:24.03-LTS |
before 3.3.6-4.oe2403 | 3.3.6-4.oe2403 |
hadoopopenEuler:22.03-LTS-SP4 |
before 3.3.6-3.oe2203sp4 | 3.3.6-3.oe2203sp4 |
hadoopopenEuler:22.03-LTS-SP1 |
before 3.3.4-4.oe2203sp1 | 3.3.4-4.oe2203sp1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-23454 is a medium vulnerability (CVSS 6.2) in Apache Hadoop, published September 25, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in org.apache.hadoop:hadoop-common 3.4.0.
References
issues.apache.org/jira/browse/HADOOP-19031
lists.apache.org/thread/xlo7q8kn4tsjvx059r789oz19hzgfkfs
openwall.com/lists/oss-security/2024/09/25/1
security.netapp.com/advisory/ntap-20241101-0002
nvd.nist.gov/vuln/detail/CVE-2024-23454
github.com/apache/hadoop/commit/8c2836402fbb2f619f1fef4ef625a8542e853a64
Show 9 moreShow less
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-2347
Left out here: 29 versions. The JSON record has them.