What is CVE-2021-21429?

CVE-2021-21429 is a medium-severity security vulnerability in org.openapitools:openapi-generator-maven-plugin (maven), affecting versions < 5.1.0. It is fixed in 5.1.0.

How severe is CVE-2021-21429?

CVE-2021-21429 has a CVSS score of 4.0 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Which versions of org.openapitools:openapi-generator-maven-plugin are affected by CVE-2021-21429?

org.openapitools:openapi-generator-maven-plugin (maven) versions < 5.1.0 is affected.

Is there a fix for CVE-2021-21429?

Yes. CVE-2021-21429 is fixed in 5.1.0. Upgrade to this version or later.

Is CVE-2021-21429 exploitable, and should I be worried?

Whether CVE-2021-21429 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2021-21429 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2021-21429?

Upgrade org.openapitools:openapi-generator-maven-plugin to 5.1.0 or later.

CVE-2021-21429

Q: How severe is CVE-2021-21429?

CVE-2021-21429 has a CVSS score of 4.0 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Q: Which versions of org.openapitools:openapi-generator-maven-plugin are affected by CVE-2021-21429?

org.openapitools:openapi-generator-maven-plugin (maven) versions < 5.1.0 is affected.

Q: Is there a fix for CVE-2021-21429?

Yes. CVE-2021-21429 is fixed in 5.1.0. Upgrade to this version or later.

Q: Is CVE-2021-21429 exploitable, and should I be worried?

Whether CVE-2021-21429 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2021-21429 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2021-21429?

Upgrade org.openapitools:openapi-generator-maven-plugin to 5.1.0 or later.

Summary

Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin

For more information

If you have any questions or comments about this advisory:

Open an issue in OpenAPI Generator Github repo
Email us at [email protected]

Impact

Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. This vulnerability only impacts unix-like systems where the local system temporary directory is shared between all users. This vulnerability does not impact Windows or modern versions of MacOS.

OpenAPI Generator Maven plug-in creates insecure temporary files during the code generation process. It creates insecure temporary files to store the OpenAPI specification files provided by the users and these temporary files can be read by any users in the system.

The impact of this vulnerability is information disclosure of the contents of the specification file to other local users.

CVE-2021-21429 has a CVSS score of 4.0 (Medium). The vector is requires local access, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (5.1.0); upgrading removes the vulnerable code path.

Affected versions

org.openapitools:openapi-generator-maven-plugin (< 5.1.0)

Security releases

org.openapitools:openapi-generator-maven-plugin → 5.1.0 (maven)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

The issue has been patched with Files.createTempFile and released in the v5.1.0 stable version.

Frequently Asked Questions

What is CVE-2021-21429? CVE-2021-21429 is a medium-severity security vulnerability in org.openapitools:openapi-generator-maven-plugin (maven), affecting versions < 5.1.0. It is fixed in 5.1.0.
How severe is CVE-2021-21429? CVE-2021-21429 has a CVSS score of 4.0 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
Which versions of org.openapitools:openapi-generator-maven-plugin are affected by CVE-2021-21429? org.openapitools:openapi-generator-maven-plugin (maven) versions < 5.1.0 is affected.
Is there a fix for CVE-2021-21429? Yes. CVE-2021-21429 is fixed in 5.1.0. Upgrade to this version or later.
Is CVE-2021-21429 exploitable, and should I be worried? Whether CVE-2021-21429 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2021-21429 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2021-21429? Upgrade org.openapitools:openapi-generator-maven-plugin to 5.1.0 or later.