Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-uwy2-xgzv-dkcs
Vulnerability ID VCID-uwy2-xgzv-dkcs
Aliases CVE-2023-33695
GHSA-7mcw-xmx3-7p8m
Summary Incorrect Permission Assignment for Critical Resource Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-732 Incorrect Permission Assignment for Critical Resource
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-377 Insecure Temporary File
System Score Found at
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2023-33695
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2023-33695
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2023-33695
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2023-33695
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2023-33695
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2023-33695
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2023-33695
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2023-33695
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2023-33695
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2023-33695
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-7mcw-xmx3-7p8m
cvssv3.1 7.1 https://github.com/dromara/hutool
generic_textual HIGH https://github.com/dromara/hutool
cvssv3.1 7.1 https://github.com/dromara/hutool/commit/c33550f703f5d1d7dd71ad2992d79a5e5532ce2c
generic_textual HIGH https://github.com/dromara/hutool/commit/c33550f703f5d1d7dd71ad2992d79a5e5532ce2c
cvssv3.1 7.1 https://github.com/dromara/hutool/issues/3103
generic_textual HIGH https://github.com/dromara/hutool/issues/3103
ssvc Track https://github.com/dromara/hutool/issues/3103
cvssv3.1 7.1 https://nvd.nist.gov/vuln/detail/CVE-2023-33695
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-33695
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-33695
https://github.com/dromara/hutool
https://github.com/dromara/hutool/commit/c33550f703f5d1d7dd71ad2992d79a5e5532ce2c
https://github.com/dromara/hutool/issues/3103
CVE-2023-33695 https://nvd.nist.gov/vuln/detail/CVE-2023-33695
GHSA-7mcw-xmx3-7p8m https://github.com/advisories/GHSA-7mcw-xmx3-7p8m
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/dromara/hutool
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/dromara/hutool/commit/c33550f703f5d1d7dd71ad2992d79a5e5532ce2c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/dromara/hutool/issues/3103
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-01-03T02:21:52Z/ Found at https://github.com/dromara/hutool/issues/3103
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-33695
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.08068
EPSS Score 0.00028
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:51:22.456239+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/cn.hutool/hutool-core/CVE-2023-33695.yml 38.0.0