Improper Authentication In Apache NiFi

2022-05-1301:46:13

Google

osv.dev

0.001 Low

EPSS

Percentile

40.5%

JSON

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the “anonymous” user.

CPENameOperatorVersion
org.apache.nifi:nifieq0.0.2-incubating
org.apache.nifi:nifieq0.5.1
org.apache.nifi:nifieq0.5.0
org.apache.nifi:nifieq1.0.0
org.apache.nifi:nifieq0.2.0-incubating
org.apache.nifi:nifieq0.0.1-incubating
org.apache.nifi:nifieq0.1.0-incubating
org.apache.nifi:nifieq0.2.1
org.apache.nifi:nifieq0.3.0
org.apache.nifi:nifieq0.4.0

Name	Operator	Version
org.apache.nifi:nifi	eq	0.0.2-incubating
org.apache.nifi:nifi	eq	0.5.1
org.apache.nifi:nifi	eq	0.5.0
org.apache.nifi:nifi	eq	1.0.0
org.apache.nifi:nifi	eq	0.2.0-incubating
org.apache.nifi:nifi	eq	0.0.1-incubating
org.apache.nifi:nifi	eq	0.1.0-incubating
org.apache.nifi:nifi	eq	0.2.1
org.apache.nifi:nifi	eq	0.3.0
org.apache.nifi:nifi	eq	0.4.0