CVE-2022-26850: apache software foundation apache nifi Exposure of Resource to Wrong Sphere
Vulnerability summary
CVE-2022-26850 is a medium (CVSS 4.3) Exposure of Resource to Wrong Sphere vulnerability in apache software foundation apache nifi. EPSS estimates a 1.49% chance of exploitation in the next 30 days, higher than 73.7% of scored vulnerabilities.
Timeline
- 06-04-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediately moved the temporary file to the final configuration directory, which significantly limited the window of opportunity for access. NiFi 1.16.0 includes updates to replace the Login Identity Providers configuration without writing a file to the operating system temporary directory.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NDiffers
EPSS trend
Probability
1.49%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
0.00 pp
From 1.49% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- nifi≥ 1.14.0, < 1.16.0
Apache software foundation1 product
- apache nifiNiFi 1.14.0 to 1.15.3
Org.apache.nifi1 product
- nifi-single-user-utils< 1.16
3 vendors · 3 products
References
6 links- www.openwall.com/lists/oss-security/2022/04/06/2Mailing ListX Refsource MLISTWEBThird Party Advisory
