PT-2021-17744 · Priam · Priam

Jonathan Leitschuh · Published 2021-03-23 · Updated 2021-03-30 · CVE-2021-28100

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Priam (affected versions not specified)

Description: The issue arises from Priam's use of File.createTempFile, which sets the permissions on the created file to -rw-r--r--, allowing other users with read access to the local filesystem to read the contents of these files. This can lead to local information disclosure if the files contain sensitive information. The vulnerable locations include the MetaData.java, DoubleRing.java, and PostRestoreHook.java files in the Priam repository.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-377

Related Identifiers

CVE-2021-28100

GHSA-F4JH-WW96-9H9J

Affected Products

Priam

References · 6

• https://osv.dev/vulnerability/GHSA-f4jh-ww96-9h9j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28100 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28100 · Vendor Advisory
• https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2021-002.md · Note
• https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-f4jh-ww96-9h9j · Note
• https://t.me/cibsecurity/25342 · Telegram Post