Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.nifi:nifi-single-user-utils

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5MavenPublished

    Insufficiently Protected Credentials via Insecure Temporary File in org.apache.nifi:nifi-single-user-utils

    CVE-2022-26850 · GHSA-rvp4-r3g6-8hxq

    Affected
    • Maven org.apache.nifi:nifi-single-user-utils <= 1.15.3
    Fixed in
    1.16· Vendor fix available
    Issue
    Impact org.apache.nifi.authentication.single.user.writer.StandardLoginCredentialsWriter contains a local information disclosure vulnerability due to writing credentials (username and password) to a file that is readable by all other users on unix-like systems. On unix-like systems, the system's temporary directory is shared between all users on that system. As such, files written to that directory without setting the correct file permissions can allow other users on that system to view the contents of the files written to those temporary files. Source An insecure temporary file is created here: - https://github.com/apache/nifi/blob/6a1c7c72d5b91b9ce5d5cb5b86e3155d21e2c19b/nifi-commons/nifi-single-user-utils/src/main/java/org/apache/nifi/authentication/single/user/writer/StandardLoginCredentialsWriter.java#L75 The username and password credentials are written to this file here: -…

    Recommended action: Upgrade to 1.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →