CVE-2014-4651

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-02-18 · updated 2026-06-17
Weakness: CWE-20

Description

It was found that the jclouds scriptbuilder Statements class wrote a temporary file to a predictable location. An attacker could use this flaw to access sensitive data, cause a denial of service, or perform other attacks.

Affected products

Apache jclouds: from 1.7.3 before 1.8.0 — fixed in 1.8.0

How to fix

Upgrade to a fixed version: Apache jclouds 1.8.0. Check the vendor advisory for mitigations.

References

http://seclists.org/oss-sec/2014/q2/579
https://issues.apache.org/jira/browse/JCLOUDS-612
http://seclists.org/oss-sec/2014/q2/579
https://issues.apache.org/jira/browse/JCLOUDS-612

Get alerted when CVE-2014-4651 or the next vulnerability affects your stack