CVE-2021-23331

CVE-2021-23331 affects all versions of the com.squareup:connect package, where the prepareDownloadFile method creates temporary files with insecure permissions (-rw-r--r--) in a shared system temporary directory on Unix-like systems. This allows other local users to view the contents of files downloaded by downloadFileFromResponse. The vulnerability has a CVSS score of 3.3 (LOW), indicating a local attack vector with low complexity, requiring low privileges, and resulting in a low impact on confidentiality without affecting integrity or availability. There is no evidence of active exploitation, public exploit code, or significant community discussion, and the affected SDK version is end-of-life, with a recommended upgrade to the latest version or a workaround involving setting java.io.tmpdir to a secure location.