Vulnerability · Published Mar 29, 2022 · Assigned by Google

CVE-2021-22572Data-transfer-project information disclosure via tmp directory

Medium 5.5

In plain English

A medium-severity security flaw in Data-Transfer-Project from Google LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.1%top 97.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creates files in the the system temporary directory with world readable permissions. Any sensitive information written to theses files is visible to all other local users on unix-like systems. We recommend upgrading past commit https://github.com/google/data-transfer-project/pull/969

Affected products (as reported)

Vendor	Product	Versions
Google LLC	Data-Transfer-Project	unspecified – before 0.3.57

Weakness: CWE-377 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/google/data-transfer-project/pull/969 x_refsource_MISC
https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-22c6-wcjm-qfjg x_refsource_MISC