CVE-2021-22572: google llc data-transfer-project Insecure Temporary File
Vulnerability summary
CVE-2021-22572 is a medium (CVSS 5.5) Insecure Temporary File vulnerability in google llc data-transfer-project. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.5% of scored vulnerabilities.
Timeline
- 29-03-2022PublishedVulnerability first disclosed.
- 21-04-2025Last modifiedVulnerability information updated.
Description
On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creates files in the the system temporary directory with world readable permissions. Any sensitive information written to theses files is visible to all other local users on unix-like systems. We recommend upgrading past commit https://github.com/google/data-transfer-project/pull/969
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
0.00 pp
From 0.13% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-377Insecure Temporary FileCreating and using insecure temporary files can leave application and system data vulnerable to attack.
- CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Affected systems
Google1 product
- data_transfer_project< 0.3.57
Google llc1 product
- data-transfer-project≥ unspecified, < 0.3.57
2 vendors · 2 products
References
2 links- github.com/JLLeitschuh/security-research/security/advisories/GHSA-22c6-wcjm-qfjgX Refsource MISCThird Party Advisory