CVE-2021-28100 Netflix/Priam: Temporary Directory Information Disclosure
Local attackers can read sensitive data written by Priam due to insecure temporary file permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-28100?
CVE-2021-28100 is a medium-severity vulnerability in Netflix OSS Priam, published on 23 Mar 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. An attacker with read access to the local filesystem can read anything written there by the Priam process.
Which versions are affected by CVE-2021-28100?
2 open source packages ship an affected version, including com.netflix.priam:priam. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.netflix.priam:priam Maven | All versions to 3.1.104 | None |
com.netflix.priam:priam Maven | All versions to 3.1.104 | None |
Products include Netflix Priam.
How do I fix CVE-2021-28100?
No fix has been published for CVE-2021-28100 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-28100 being exploited?
There is no known exploitation of CVE-2021-28100 in the wild and no public exploit code.
Sources
Also known as GHSA-f4jh-ww96-9h9j.