CVE-2020-13940

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services via XXE...

CVE-2020-13940

In Apache NiFi, versions 1.0.0–1.11.4 expose a XXE-related risk in the notification service manager and certain policy authorizer and user group provider objects. The underlying issue allows an administrator-controlled XML file to trigger external calls to services, via XML External Entity proces...

CVE-2020-13940

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services via XXE...

CVE-2020-9487

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token one-time password mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens,...

CVE-2020-9487

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token one-time password mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens,...

CVE-2020-9486

In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext...

CVE-2020-9486

In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext...

PT-2020-20698

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.2.0 through 1.11.4 Description The issue concerns the support of outdated TLS versions in intracluster communication. Specifically, cluster request replication, Site-to-Site, and load balanced queues continued to support...

PT-2020-20696

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.10.0 through 1.11.4 Description The issue concerns the NiFi stateless execution engine producing log output that includes sensitive property values. When a flow is triggered, the flow definition configuration JSON is...

CVE-2020-13940: Improper Restriction of XML External Entity Reference

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services via XXE...

PT-2020-20697

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.0.0 through 1.11.4 Description The issue concerns the NiFi download token mechanism, which uses a fixed cache size and does not authenticate requests to create download tokens. This allows an unauthenticated user to...

CVE-2020-9487: Missing Authentication for Critical Function

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token one-time password mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens,...

CVE-2020-9486: Insertion of Sensitive Information into Log File

In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext...

PT-2020-13791

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.0.0 through 1.11.4 Description The issue allows trusted administrators to inadvertently configure a potentially malicious XML file, which can make external calls to services via XXE. Recommendations For Apache NiFi...

CVE-2020-9491: Use of a Broken or Risky Cryptographic Algorithm

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced...

GHSA-MVR2-9PJ6-7W5J vulnerabilities

Vulnerabilities for packages: druid...

Improper Token Handling

Apache NiFi Registry is vulnerable to authentication bypass. During logging out, the authentication mechanism other than PKI does not invalidate the token on the server side, but only on the client side, allowing the client to make a API requests up to 12 hours after logging out...

Apache NiFi Information Disclosure Vulnerability (CNVD-2020-04924)

Apache NiFi is a data-flow based data processing and distribution system of the Apache Apache Software Foundation, USA. The system supports the configuration and transformation of data routing indicator maps and system intermediary logic. An information disclosure vulnerability exists in Apache...

CVE-2020-1942

In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was...

CVE-2020-1942

In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was...