Lucene search

[email protected]NVD:CVE-2024-37389

HistoryJul 08, 2024 - 8:15 a.m.

CVE-2024-37389

2024-07-0808:15:10

CWE-79

[email protected]

web.nvd.nist.gov

apache nifi

cross-site scripting

vulnerability

parameter context

upgrading

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

27.2%

JSON

Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation.

Affected configurations

Nvd

Node

apachenifiRange1.10.0–1.27.0

apachenifiMatch2.0.0milestone1

apachenifiMatch2.0.0milestone1-rc1

apachenifiMatch2.0.0milestone1-rc2

apachenifiMatch2.0.0milestone1-rc3

apachenifiMatch2.0.0milestone1-rc4

apachenifiMatch2.0.0milestone1-rc5

apachenifiMatch2.0.0milestone1-rc6

apachenifiMatch2.0.0milestone2

apachenifiMatch2.0.0milestone2-rc1

apachenifiMatch2.0.0milestone2-rc2

apachenifiMatch2.0.0milestone2-rc3

apachenifiMatch2.0.0milestone2-rc4

apachenifiMatch2.0.0milestone3

apachenifiMatch2.0.0milestone3-rc1

VendorProductVersionCPE
apachenifi*cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*
apachenifi2.0.0cpe:2.3:a:apache:nifi:2.0.0:milestone1:*:*:*:*:*:*
apachenifi2.0.0cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc1:*:*:*:*:*:*
apachenifi2.0.0cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc2:*:*:*:*:*:*
apachenifi2.0.0cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc3:*:*:*:*:*:*
apachenifi2.0.0cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc4:*:*:*:*:*:*
apachenifi2.0.0cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc5:*:*:*:*:*:*
apachenifi2.0.0cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc6:*:*:*:*:*:*
apachenifi2.0.0cpe:2.3:a:apache:nifi:2.0.0:milestone2:*:*:*:*:*:*
apachenifi2.0.0cpe:2.3:a:apache:nifi:2.0.0:milestone2-rc1:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	nifi	*	cpe:2.3:a:apache:nifi::::::::
apache	nifi	2.0.0	cpe:2.3:a:apache:nifi:2.0.0:milestone1::::::
apache	nifi	2.0.0	cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc1::::::
apache	nifi	2.0.0	cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc2::::::
apache	nifi	2.0.0	cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc3::::::
apache	nifi	2.0.0	cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc4::::::
apache	nifi	2.0.0	cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc5::::::
apache	nifi	2.0.0	cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc6::::::
apache	nifi	2.0.0	cpe:2.3:a:apache:nifi:2.0.0:milestone2::::::
apache	nifi	2.0.0	cpe:2.3:a:apache:nifi:2.0.0:milestone2-rc1::::::