TI-2022-03623 Aliases CVE-2022-3952 GHSA-925r-r6rp-2jj7

ManyDesigns Portofino WarFileLauncher.java createTempDir temp file

MEDIUM 64CWE-377Published 2022-11-11 · Updated 2025-04-15

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

A vulnerability has been found in ManyDesigns Portofino 5.3.2 and classified as problematic. Affected by this vulnerability is the function createTempDir of the file WarFileLauncher.java. The manipulation leads to creation of temporary file in directory with insecure permissions. Upgrading to version 5.3.3 is able to address this issue. The name of the patch is 94653cb357806c9cf24d8d294e6afea33f8f0775. It is recommended to upgrade the affected component. The identifier VDB-213457 was assigned to this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00594 48th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed com.manydesigns:portofino (Maven): 5.3.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ManyDesigns	Portofino	5.3.2	—	No fix listed	CNA
—	com.manydesigns:portofino (Maven)	before 5.3.3	5.3.3	Patch available	GHSA-925r-r6rp-2jj7

Portofino VendorManyDesigns Affected 5.3.2 Fixed in — No fix listed CNA
com.manydesigns:portofino (Maven) Vendor— Affected before 5.3.3 Fixed in 5.3.3 Patch available GHSA-925r-r6rp-2jj7

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:manydesigns:portofino:5.3.2:::::::*	5.3.2	Vulnerable	ManyDesigns

cpe:2.3:a:manydesigns:portofino:5.3.2:*:*:*:*:*:*:* Versions 5.3.2 Vulnerable ·ManyDesigns

Remediation

Fix · GHSA-925r-r6rp-2jj7 com.manydesigns:portofino (Maven) Fixed in 5.3.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-3952
2026-10-03 Alias added: GHSA-925r-r6rp-2jj7

References

Exploit 1

https://github.com/ManyDesigns/Portofino/pull/580

Patch 1

https://github.com/ManyDesigns/Portofino/commit/94653cb357806c9cf24d8d294e6afea33f8f0775

Advisory 2

Other 1

https://github.com/ManyDesigns/Portofino

TI-2021-10164 Missing validation of JWT signature in `ManyDesigns/Portofino` CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences