Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-26850

CVE-2022-26850: Insufficiently Protected Credentials via Insecure Temporary File in org.apache.nifi:nifi-single-user-utils

6.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-26850
GHSA ID
GHSA-rvp4-r3g6-8hxq
EPSS Score
0.72388%
CWE
CWE-522
Published
6/20/2022
Updated
8/17/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.nifi:nifi-single-user-utilsmaven<= 1.15.31.16

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the use of File.createTempFile() in writeLoginCredentials, which creates a file in the system temp directory with insecure permissions. The credentials were written to this temporary file (lines 85-95) before being moved, leaving a window where other users could read them. The commit diff shows the patched version eliminated the temp file creation, confirming this was the vulnerable code path.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t `or*.*p****.ni*i.*ut**nti**tion.sin*l*.us*r.writ*r.St*n**r*Lo*in*r***nti*lsWrit*r` *ont*ins * lo**l in*orm*tion *is*losur* vuln*r**ility *u* to writin* *r***nti*ls (us*rn*m* *n* p*sswor*) to * *il* t**t is r*****l* *y *ll ot**r us*rs on u

Reasoning

T** vuln*r**ility st*ms *rom t** us* o* `*il*.*r**t*T*mp*il*()` in writ*Lo*in*r***nti*ls, w*i** *r**t*s * *il* in t** syst*m t*mp *ir**tory wit* ins**ur* p*rmissions. T** *r***nti*ls w*r* writt*n to t*is t*mpor*ry *il* (lin*s **-**) ***or* **in* mov*