{"id":"CVE-2022-41954","summary":"Temporary File Information Disclosure Vulnerability","details":"MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of `File.createTempFile(..)` results in temporary files being created with the permissions `-rw-r--r--`. This means that any other user on the system can read the contents of this file. When MPXJ is reading a schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ. The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes. Users unable to upgrade may set `java.io.tmpdir` to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.","aliases":["GHSA-jf2p-4gqj-849g","PYSEC-2022-42996"],"modified":"2026-08-12T13:33:32.424350Z","published":"2022-11-25T00:00:00Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-200","CWE-377"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41954.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41954.json"},{"type":"ADVISORY","url":"https://github.com/joniles/mpxj/security/advisories/GHSA-jf2p-4gqj-849g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41954"},{"type":"FIX","url":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/joniles/mpxj","events":[{"introduced":"0"},{"fixed":"91583f6df87fc4589cafc5970b310c49c6619598"},{"fixed":"ae0af24345d79ad45705265d9927fe55e94a5721"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:mpxj:mpxj:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"10.14.1"}]}}],"versions":["v10.13.0","v10.12.0","v10.10.0","v10.9.1","v10.9.0","v10.8.0","v10.7.0","v10.6.2","v10.6.1","v10.6.0","v10.5.0","v10.4.0","v10.3.0","v10.2.0","v10.1.0","v10.0.5","v10.0.4","v10.0.3","v10.0.2","v10.0.1","v10.0.0","v9.8.3","v9.8.2","v9.8.1","v9.8.0","v9.7.0","v9.6.0","v9.5.2","v9.5.1","v9.5.0","v9.4.0","v9.3.1","v9.3.0","v9.2.6","v9.2.5","v9.2.4","v9.2.3","v9.2.2","v9.2.1","v9.2.0","v9.1.0","v9.0.0","v8.5.1","v8.5.0","v8.4.0","v8.3.5","v8.3.4","v8.3.3","v8.3.2","v8.3.1","v8.3.0","v8.2.0","v8.1.4","v8.1.3","v8.1.2","v8.1.1","v8.1.0","v8.0.8","v8.0.7","v8.0.6","v8.0.5","v8.0.4","v8.0.3","v8.0.2","v8.0.0","v7.9.8","v7.9.7","v7.9.6","v7.9.5","v7.9.4","v7.9.3","v7.9.2","v7.9.1","v7.9.0","v7.8.4","v7.8.3","v7.8.2","v7.8.1","v7.8.0","v7.7.1","v7.7.0","v7.6.3","v7.6.2","v7.6.1","v7.6.0","v7.5.0","v7.4.4","v7.4.3","v7.4.2","v7.4.1","v7.4.0","v7.3.0","v7.2.1","v7.2.0","v7.1.0","v7.0.3","v7.0.2","v7.0.1","v7.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-41954.json","vanir_signatures_modified":"2026-08-12T13:33:32Z","vanir_signatures":[{"source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/main/java/net/sf/mpxj/common/InputStreamHelper.java","function":"writeStreamToTempFile"},"deprecated":false,"digest":{"function_hash":"207919617671157132338796966166564106193","length":398},"id":"CVE-2022-41954-0b308a20","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"178055291695557028579733946090556430348","length":423},"id":"CVE-2022-41954-1da99c97","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testRewrite3"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"function":"testConversion2","file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java"},"deprecated":false,"digest":{"function_hash":"173774423866596691585030233337896787515","length":301},"id":"CVE-2022-41954-1ed1347e"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/main/java/net/sf/mpxj/common/FileHelper.java"},"deprecated":false,"digest":{"line_hashes":["74489436825610265151578218545316610250","238670370067738485819368605305059159622","191060846359885594838816412201981456112","100969369267536403163614209875949713570","213256681339066958026756241725907348543","74024882818267680069579127470155962862","203305021355694054151544675810520650175"],"threshold":0.9},"id":"CVE-2022-41954-21222a71"},{"digest":{"length":381,"function_hash":"118856000820088716878603156011096088339"},"id":"CVE-2022-41954-3d488a78","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testRewrite2"},"deprecated":false},{"target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testConversion1"},"deprecated":false,"digest":{"function_hash":"152760715678146800542747224342718152504","length":303},"id":"CVE-2022-41954-459804eb","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721"},{"deprecated":false,"digest":{"function_hash":"220307673218345968212806303468251738692","length":2769},"id":"CVE-2022-41954-4ae7664d","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testRemoval"}},{"signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/LocaleTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["115850225773780599112115942915032458997","70454129356380452447786110989256518338","97555230627462117811281159815460069691","267946491997826241244041343247614433719","173986165848491144942306933648219234170","221430736674974921966740372970578478209","46469780069406821198484768312323272104"]},"id":"CVE-2022-41954-4ce527a9","signature_type":"Line"},{"id":"CVE-2022-41954-53f3ccaf","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testConversion3"},"deprecated":false,"digest":{"function_hash":"335724141818999977302303530215158069277","length":301}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testProjectCalendarExceptions"},"deprecated":false,"digest":{"function_hash":"65848209770091984161396220527306206914","length":434},"id":"CVE-2022-41954-5ee75383"},{"source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testMspdiExtendedAttributes"},"deprecated":false,"digest":{"function_hash":"70460384850105430107819258984348387942","length":353},"id":"CVE-2022-41954-699e6479","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/LocaleTest.java","function":"testLocale"},"deprecated":false,"digest":{"function_hash":"307688049385276496544293576149370155829","length":427},"id":"CVE-2022-41954-6a5c559f","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2022-41954-70b7db65","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testRewrite1"},"deprecated":false,"digest":{"function_hash":"129554035301516644813314641988971565974","length":422}},{"digest":{"function_hash":"26501837355241598767878211396802582624","length":142},"id":"CVE-2022-41954-86f67495","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/main/java/net/sf/mpxj/common/FileHelper.java","function":"createTempDir"},"deprecated":false},{"source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/CustomerDataTest.java","function":"testPrimaveraDatabase"},"deprecated":false,"digest":{"function_hash":"244149362052159954514533348698521882515","length":838},"id":"CVE-2022-41954-8d8f1755","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2022-41954-999301c0","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testTaskNotes"},"deprecated":false,"digest":{"function_hash":"257290511488098291102579563034691721068","length":2066}},{"deprecated":false,"digest":{"line_hashes":["97884479263220489366504267417587610172","194878560671389154146566413128132933481","50261745905978165436220022659438711224","80909052875716945947311384729698117736","313358443821031860410343690506346466935","302684630062963206004373509096554792255","283441347003155962731615769002633453870","338369490506758950591456284657637192044"],"threshold":0.9},"id":"CVE-2022-41954-99e319ba","signature_type":"Line","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/main/java/net/sf/mpxj/common/InputStreamHelper.java"}},{"digest":{"length":741,"function_hash":"140623001462752498939683496521806239260"},"id":"CVE-2022-41954-9ea36f90","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/CustomerDataTest.java","function":"testBaseline"},"deprecated":false},{"id":"CVE-2022-41954-a4c77b98","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testResourceNotes"},"deprecated":false,"digest":{"function_hash":"197323784047284051787107766306005569003","length":1566}},{"deprecated":false,"digest":{"function_hash":"324417361973929810368057848635091001367","length":280},"id":"CVE-2022-41954-a918bf1d","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testBug2"}},{"deprecated":false,"digest":{"function_hash":"319288712956307962778680709957223158847","length":380},"id":"CVE-2022-41954-aa9cf02c","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testMSPDIAliases"}},{"id":"CVE-2022-41954-baa9a007","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"function":"testEmbeddedLineBreaks","file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java"},"deprecated":false,"digest":{"function_hash":"312635600181857168075366048113840102192","length":1490}},{"source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testBug4"},"deprecated":false,"digest":{"function_hash":"93294439027969350962409331764278591230","length":295},"id":"CVE-2022-41954-c78bba6b","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testRewrite5"},"deprecated":false,"digest":{"function_hash":"210749647181822603918765870584727423277","length":286},"id":"CVE-2022-41954-c7fdcbf3","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721"},{"source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["309097033171688085122745746253487895731","149196685401754045000354775552329295137","200966410619855364670652041382436996098","182776433285562999820421899511991768974","196713948675526941066922995899636960357","7646322096242286505829076635582477538","111600517485256995990541857340932047721","263148233166921922258280835979232048029","993660949311539015706751741439208047","157170316837849858077522576686331560637","200688242017523974174232472675188791333","117190890491452474458261979364377298965","329110664080981830446282497283760421056","7646322096242286505829076635582477538","111600517485256995990541857340932047721","243797137785758898662550459481930542672","65561380987492008149786077605837392426","147962913388464110849811895184464907904","111600517485256995990541857340932047721","337484137147578398494558703063530019159","11776520203595800279162272114440620649","39701538424556230089249042135862857046","187277942775892044274302730760584915122","249479248653981283576746559072979264213","160741399080265313786739676814075507191","21496822169943522680348374096672037509","134727528884045053547392961981082376101","113041874093078385487550329292944880948","172063949745461082549606569714039824626","21496822169943522680348374096672037509","134727528884045053547392961981082376101","336290926593310050413262505981094991757","132491053751150118597187807707740136780","227231138495187980794156554683345927897","202194882595415474223746717729704365395","113041874093078385487550329292944880948","172063949745461082549606569714039824626","96789620742303677241446126257307642717","88732677366899371568953424139636453926","150677040776432421404766314628754232939","308522716077110478883296734831864055047","236290523402139401754425020526183174415","319207469417100712579096075077090132980","233809484146691194420913168176124807147","211654261289673400445678239925824997432","196162128986760100322029899985398431702","222265332882825731258464279775451650595","323250272754724018512199734637901432620","53876535241182157742136884770311195198","249549924680013799394200972509865510958","222265332882825731258464279775451650595","106781962488916489895251010888767816913","227081340104750678450596306939093984656","287096918247019803518193670440323260940","1999248500273154755407199439715278319","153761379306285738960671271107478587244","126457831147379296829277506486199379605","287096918247019803518193670440323260940","1999248500273154755407199439715278319","46536070852040534006224465953295360026","300912039260192198763591309239293221857","233486166124722066875776938595927299832","35764623780541740208924524460589227642","206881371896010096572364365818344070234","99985650768034742796201983376275247223","165765178349683857399616291635234278490","27442701924420565036386370608859853567","156670497643589659179828475142012039511","69979281876662774299401830183744105083","302852228628555246467377547242138052406","274617787264591111373866347133111510454","174564089333931133817308569611652370054","296383551767192985624038854607900669256","170136120454072991440910904225254258408","234723874063184458666479221751430076472","11209053842405094242239532811599325818","77438502708662547872779431921094857094","216165071707164761427531105961386578754","225400936290688524630141184754411611835","258172962584358861279135099691069803477","59257472159682432819466636393825271288","144191515109747098186695383501163506651","283025273412476559364438837323760072231","170214090316485606382150337152663097304","9514392386281681562429318526442119321","11684558171193225796184785764105402726","320043613782988942732284969812688990363","228924733143945394170368975590737555608","30583150900850904724512435725645687319","114240497418192862764314372829316783","202478100767448702377614593666653762283","46427355672575999161525774280788265986","150941269532362377750150289341501416667","176443293890141794640715085538389349225","73530181637962781415226519100102747568","279478035026147884889495230334260562219","46461225045101729765864726824718024926","289840905352972149103457986672799726110","232850597449893984819335292973612318161","290337865552378521645833291205495805901","595839382599314000741534250655093978","4413425328907878392267865857171637240","7646322096242286505829076635582477538","111600517485256995990541857340932047721"]},"id":"CVE-2022-41954-c8226e8b","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testProjectProperties"},"deprecated":false,"digest":{"length":863,"function_hash":"207664281177577544662872874755075106149"},"id":"CVE-2022-41954-cdaa04f6"},{"signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testRewrite4"},"deprecated":false,"digest":{"function_hash":"311947463701804466710825692708855970859","length":565},"id":"CVE-2022-41954-cfe2df4d","signature_type":"Function"},{"id":"CVE-2022-41954-d5b9d5af","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"function":"testBug1","file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java"},"deprecated":false,"digest":{"function_hash":"110941374421933852887050922447143880186","length":280}},{"deprecated":false,"digest":{"function_hash":"235708185329542669687912863394538820750","length":662},"id":"CVE-2022-41954-dbbc281a","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testTaskCalendars"}},{"id":"CVE-2022-41954-ef749f63","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testPriority"},"deprecated":false,"digest":{"function_hash":"282010226020794131367879893666750249125","length":881}},{"deprecated":false,"digest":{"function_hash":"286087227665406347715240119245326669004","length":443},"id":"CVE-2022-41954-f54df432","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/legacy/BasicTest.java","function":"testConversion4"}},{"digest":{"line_hashes":["161859997355936199651482028129577074597","321716357601044572744530710049689440213","153835409245505605390562137759951090172","110168980066141505244496365900936047037","245859500792969639005065091540824545803","87821939595989412319925232047230269577","307542740801210217740130669782204200757","22851536396517876637091995654141721512"],"threshold":0.9},"id":"CVE-2022-41954-fc29d4c9","signature_type":"Line","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721","target":{"file":"src/test/java/net/sf/mpxj/junit/CustomerDataTest.java"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}