VulnerabilityModified
CVE-2021-22572
On unix-like systems, the system temporary directory is shared between all users on that system.
MEDIUM 5.5EPSS 0.13%
Does this matter?
Lower severity and a low EPSS score (0.13%). Track it; it rarely justifies an emergency change on its own.
Description
On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creates files in the the system temporary directory with world readable permissions. Any sensitive information written to theses files is visible to all other local users on unix-like systems. We recommend upgrading past commit https://github.com/google/data-transfer-project/pull/969
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.13% probability · 3th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-377, CWE-668
- Affected
- google/data transfer project
- Source
- cve-coordination@google.com
References
- https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-22c6-wcjm-qfjgThird Party Advisory
- https://github.com/google/data-transfer-project/pull/969Patch, Third Party Advisory
- https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-22c6-wcjm-qfjgThird Party Advisory
- https://github.com/google/data-transfer-project/pull/969Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.