Lucene search

ApacheCVE-2019-10083

HistoryNov 19, 2019 - 10:15 p.m.

CVE-2019-10083

2019-11-1922:15:11

CWE-200

apache

web.nvd.nist.gov

cve

nifi

api

update

security

unauthorized access

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

24.2%

JSON

When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.

Affected configurations

Nvd

Vulners

Node

apachenifiRange1.3.0–1.9.2

VendorProductVersionCPE
apachenifi*cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	nifi	*	cpe:2.3:a:apache:nifi::::::::

CNA Affected

[
  {
    "product": "Apache NiFi",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Apache NiFi 1.3.0 to 1.9.2"
      }
    ]
  }
]

References

lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E

nifi.apache.org/security.html#CVE-2019-10083

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

24.2%

JSON

Related for CVE-2019-10083