Apache NiFi cross-site scripting vulnerability (CNVD-2023-9665850)

2023-11-3000:00:00

China National Vulnerability Database

www.cnvd.org.cn

apache; nifi; cross-site scripting; vulnerability; jolttransformjson; data processing; apache foundation; usa; data routing; system mediation logic; web script; html; attacker; crafted payload; data filtering; user interface; security vulnerability; cnvd-2023-9665850.

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.7%

JSON

Apache NiFi is a data processing and distribution system from the Apache (USA) Foundation. The system is primarily used for data routing, transformation and system mediation logic. Apache NiFi suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the advanced configuration user interface of the JoltTransformJSON processor, which can be exploited by an attacker to execute arbitrary web script or HTML by injecting a crafted payload.

CPENameOperatorVersion
apache nifi >=0.7.0，le1.23.2

CPE	Name	Operator	Version
	apache nifi >=0.7.0，	le	1.23.2