CVE-2020-9486

2020-10-0120:15:14

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.9%

JSON

In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext.

CPENameOperatorVersion
nifieqrel/nifi-1.4.0
nifieqnifi-1.11.2-RC1
nifieqnifi-1.6.0-RC3
nifieqnifi-1.1.0-RC2
nifieqrel/nifi-1.11.3
nifieqrel/nifi-1.11.0
nifieqnifi-1.10.0-RC3
nifieqnifi-1.11.0-RC3
nifieqrel/nifi-1.11.2
nifieqrel/nifi-1.10.0

Name	Operator	Version
nifi	eq	rel/nifi-1.4.0
nifi	eq	nifi-1.11.2-RC1
nifi	eq	nifi-1.6.0-RC3
nifi	eq	nifi-1.1.0-RC2
nifi	eq	rel/nifi-1.11.3
nifi	eq	rel/nifi-1.11.0
nifi	eq	nifi-1.10.0-RC3
nifi	eq	nifi-1.11.0-RC3
nifi	eq	rel/nifi-1.11.2
nifi	eq	rel/nifi-1.10.0