1. Home
  2. CVE Database
  3. CVE-2021-22572
MEDIUM · 5.5

CVE-2021-22572

On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creates files in the the system temporary directory with world re...

Vulnerability Description

On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creates files in the the system temporary directory with world readable permissions. Any sensitive information written to theses files is visible to all other local users on unix-like systems. We recommend upgrading past commit https://github.com/google/data-transfer-project/pull/969

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
GoogleData Transfer Project< 0.3.57

Related Weaknesses (CWE)

CWE-668CWE-377

References

FAQ

What is CVE-2021-22572?

CVE-2021-22572 is a vulnerability with a CVSS score of 5.5 (MEDIUM). On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creates files in the the system temporary directory with world re...

How severe is CVE-2021-22572?

CVE-2021-22572 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-22572?

Check the references section above for vendor advisories and patch information. Affected products include: Google Data Transfer Project.