Improper File Permissions in Priam by Netflix

CVE-2021-28100

What is CVE-2021-28100?

Priam, a management tool for Apache Cassandra, faces a security concern due to its handling of temporary files. The application uses File.createTempFile to generate temporary files with default permissions set to -rw-r--r--. This configuration allows attackers with read access to the local filesystem to potentially access sensitive data written by the Priam process. Addressing this vulnerability is essential to prevent unauthorized data exposure that could lead to further security risks.

References