apache nifi CVE-2022-26850 is a vulnerability in Apache NiFi
Published on April 6, 2022

Insufficiently protected credentials
When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediately moved the temporary file to the final configuration directory, which significantly limited the window of opportunity for access. NiFi 1.16.0 includes updates to replace the Login Identity Providers configuration without writing a file to the operating system temporary directory.

Github Repository NVD


Products Associated with CVE-2022-26850

Want to know whenever a new CVE is published for Apache NiFi? stack.watch will email you.

Apache NiFi
 

Affected Versions

Apache Software Foundation Apache NiFi Version NiFi 1.14.0 to 1.15.3 is affected by CVE-2022-26850

Vulnerable Packages

The following package name and versions may be associated with CVE-2022-26850

Package Manager Vulnerable Package Versions Fixed In
maven org.apache.nifi:nifi-single-user-utils <= 1.15.3 1.16

Exploit Probability

EPSS
1.93%
Percentile
83.15%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.