Cross-site Scripting in Apache NiFi

2022-05-1401:05:57

Google

osv.dev

0.001 Low

EPSS

Percentile

28.6%

JSON

In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.

CPENameOperatorVersion
org.apache.nifi:nifieq1.0.0
org.apache.nifi:nifieq0.0.1-incubating
org.apache.nifi:nifieq0.3.0
org.apache.nifi:nifieq0.5.0
org.apache.nifi:nifieq1.0.0-BETA
org.apache.nifi:nifieq0.0.2-incubating
org.apache.nifi:nifieq0.7.0
org.apache.nifi:nifieq0.1.0-incubating
org.apache.nifi:nifieq0.4.0
org.apache.nifi:nifieq0.7.4

Name	Operator	Version
org.apache.nifi:nifi	eq	1.0.0
org.apache.nifi:nifi	eq	0.0.1-incubating
org.apache.nifi:nifi	eq	0.3.0
org.apache.nifi:nifi	eq	0.5.0
org.apache.nifi:nifi	eq	1.0.0-BETA
org.apache.nifi:nifi	eq	0.0.2-incubating
org.apache.nifi:nifi	eq	0.7.0
org.apache.nifi:nifi	eq	0.1.0-incubating
org.apache.nifi:nifi	eq	0.4.0
org.apache.nifi:nifi	eq	0.7.4