Insufficiently Protected Credentials via Insecure Temporary File in org.apache.nifi:nifi-single-user-utils
Impact
org.apache.nifi.authentication.single.user.writer.StandardLoginCredentialsWriter contains a local information disclosure vulnerability due to writing credentials (username and password) to a file that is readable by all other users on unix-like systems. On unix-like systems, the system's temporary directory is shared between all users on that system. As such, files written to that directory without setting the correct file permissions can allow other users on that system to view the contents of the files written to those temporary files.
Source
An insecure temporary file is created here:
The username and password credentials are written to this file here:
Patches
The vulnerability has been patched in version 1.16.
Prerequisites
This vulnerability impacts Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.
Workarounds
Setting the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability for all operating systems.
References
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | org.apache.nifi:nifi-single-user-utils | < 1.16 | 1.16 |
Referencias
- https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-rvp4-r3g6-8hxq
- https://nvd.nist.gov/vuln/detail/CVE-2022-26850
- https://github.com/apache/nifi/commit/859d5fe
- https://github.com/apache/nifi/commit/859d5fe8cfe05ad24600b021f0ebf15753a8105c
- https://nifi.apache.org/security.html#CVE-2022-26850
- http://www.openwall.com/lists/oss-security/2022/04/06/2
- Vector CVSS
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N- Debilidad (CWE)
CWE-522- Plataforma
- Java / Kotlin (Maven)
- Paquete
org.apache.nifi:nifi-single-user-utils- Publicada
- 20.06.2022
- Actualizado
- 11.10.2026 12:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-rvp4-r3g6-8hxq - CC BY 4.0
Historial de vulnerabilidades: org.apache.nifi:nifi-single-user-utils
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.