In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.

The version of junit installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-15250 advisory.

  - In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information     disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all     users on that system. Because of this, when files and directories are written into this directory they     are, by default, readable by other users on that same system. This vulnerability does not allow other     users to overwrite the contents of these directories or files. This is purely an information disclosure     vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API     keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS     has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix     is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability     is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround     below. If you are unable to patch, or are stuck running on Java 1.6, specifying the `java.io.tmpdir`     system environment variable to a directory that is exclusively owned by the executing user will fix this     vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub     Security Advisory. (CVE-2020-15250)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (GlassFish Server)). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and     14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the     infrastructure where Oracle WebLogic Server executes to compromise Oracle WebLogic Server. Successful     attacks require human interaction from a person other than the attacker. Successful attacks of this     vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic     Server accessible data. (CVE-2020-15250)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
    Supported versions that are affected are 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle WebLogic Server. (CVE-2025-61752)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
    Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of     Oracle WebLogic Server accessible data. (CVE-2025-61764)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (Apache Commons Lang)). The supported version that is affected is 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle WebLogic Server. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information     disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all     users on that system. Because of this, when files and directories are written into this directory they     are, by default, readable by other users on that same system. This vulnerability does not allow other     users to overwrite the contents of these directories or files. This is purely an information disclosure     vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API     keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS     has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix     is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability     is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround     below. If you are unable to patch, or are stuck running on Java 1.6, specifying the `java.io.tmpdir`     system environment variable to a directory that is exclusively owned by the executing user will fix this     vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub     Security Advisory. (CVE-2020-15250)

Note that Nessus relies on the presence of the package as reported by the vendor.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory.

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: EAI (JSON-java)). Supported     versions that are affected are 23.5 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Siebel CRM. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel     CRM. (CVE-2020-15250, CVE-2022-45688)

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: Siebel Core (Apache ZooKeeper)).
    Supported versions that are affected are 23.5 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Siebel CRM. (CVE-2020-36518, CVE-2020-9493, CVE-2021-21295, CVE-2021-37533, CVE-2022-2048,     CVE-2022-23307, CVE-2022-41915, CVE-2022-42003, CVE-2022-42004)

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework (jQueryUI)).
    Supported versions that are affected are 23.5 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM. Successful attacks require     human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM,     attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM accessible     data as well as unauthorized read access to a subset of Siebel CRM accessible data. (CVE-2022-31160)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the junit package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In JUnit4 from version 4.7 and before 4.13.1, the test     rule TemporaryFolder contains a local information     disclosure vulnerability. On Unix like systems, the     system's temporary directory is shared between all     users on that system. Because of this, when files and     directories are written into this directory they are,     by default, readable by other users on that same     system. This vulnerability does not allow other users     to overwrite the contents of these directories or     files. This is purely an information disclosure     vulnerability. This vulnerability impacts you if the     JUnit tests write sensitive information, like API keys     or passwords, into the temporary folder, and the JUnit     tests execute in an environment where the OS has other     untrusted users. Because certain JDK file system APIs     were only added in JDK 1.7, this this fix is dependent     upon the version of the JDK you are using. For Java 1.7     and higher users: this vulnerability is fixed in     4.13.1. For Java 1.6 and lower users: no patch is     available, you must use the workaround below. If you     are unable to patch, or are stuck running on Java 1.6,     specifying the `java.io.tmpdir` system environment     variable to a directory that is exclusively owned by     the executing user will fix this vulnerability. For     more information, including an example of vulnerable     code, see the referenced GitHub Security     Advisory.(CVE-2020-15250)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4731-1 advisory.

    It was discovered that JUnit 4 contains a local information disclosure vulnerability. An attacker could     possibly use this issue to obtain sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

In junit4 the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users.

For Debian 9 stretch, this problem has been fixed in version 4.12-4+deb9u1.

We recommend that you upgrade your junit4 packages.

For the detailed security status of junit4 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/junit4

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
296033	Azure Linux 3.0 Security Update: junit (CVE-2020-15250)	Nessus	Azure Linux Local Security Checks	medium
271253	Oracle WebLogic Server (October 2025 CPU)	Nessus	Misc.	high
223316	Linux Distros Unpatched Vulnerability : CVE-2020-15250	Nessus	Misc.	medium
212439	Oracle Siebel Server <= 23.5 (July 2023 CPU)	Nessus	Misc.	critical
153320	EulerOS 2.0 SP2 : junit (EulerOS-SA-2021-2391)	Nessus	Huawei Local Security Checks	medium
149617	EulerOS 2.0 SP5 : junit (EulerOS-SA-2021-1903)	Nessus	Huawei Local Security Checks	medium
149543	EulerOS 2.0 SP8 : junit (EulerOS-SA-2021-1878)	Nessus	Huawei Local Security Checks	medium
149131	EulerOS 2.0 SP3 : junit (EulerOS-SA-2021-1807)	Nessus	Huawei Local Security Checks	medium
146384	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : JUnit 4 vulnerability (USN-4731-1)	Nessus	Ubuntu Local Security Checks	medium
142206	Debian DLA-2426-1 : junit4 security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-15250

medium

Tenable Plugins

medium

high

medium

critical

medium

medium

medium

medium

medium

medium