PT-2022-18100 · Apache · Apache Nifi

David Handermann

+1

·

Published

2022-04-06

·

Updated

2025-09-12

·

CVE-2022-26850

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 1.16.0
Description The issue arises when creating or updating credentials for single-user access in Apache NiFi. NiFi writes a copy of the Login Identity Providers configuration to the operating system temporary directory, which has global read permissions on most platforms. Although NiFi immediately moves the temporary file to the final configuration directory, limiting the window of opportunity for access, the vulnerability still exists. The org.apache.nifi.authentication.single.user.writer.StandardLoginCredentialsWriter class contains a local information disclosure vulnerability due to writing credentials to a file readable by all other users on Unix-like systems.
Recommendations For versions prior to 1.16.0, update to Apache NiFi 1.16.0 or later to replace the Login Identity Providers configuration without writing a file to the operating system temporary directory. As a temporary workaround, consider setting the java.io.tmpdir system environment variable to a directory exclusively owned by the executing user to fix this vulnerability for all operating systems.

Fix

Insufficiently Protected Credentials

Exposure of Resource to Wrong Sphere

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BIT-NIFI-2022-26850
CVE-2022-26850
GHSA-RVP4-R3G6-8HXQ

Affected Products

Apache Nifi