Description
Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. An attacker with read access to the local filesystem can read anything written there by the Priam process.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_misc
https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2021-002.md
Scores
CVSS v3
5.5
EPSS
0.0004
EPSS Percentile
13.3%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
Status
published
Products (2)
com.netflix.priam/priam
0Maven
netflix/priam
Published
Mar 23, 2021
Tracked Since
Feb 18, 2026