CVE-2019-10083

When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents at the top most level, not recursively. The response included details about processors and controller services which the user may not have had read access to...

org.apache.nifi:nifi-framework-nar (>=1.3.0, <=1.9.2), org.apache.nifi:nifi-jetty (>=1.3.0, <=1.9.2) potentially affected by CVE-2019-10083 via org.apache.nifi:nifi-web-api (>=1.3.0, <=1.9.2)

org.apache.nifi:nifi-web-api MAVEN version =1.3.0, =1.3.0, =1.3.0, =1.9.2 Source cves: CVE-2019-10083 Source advisory: OSV:GHSA-26P8-XRJ2-MV53...

CVE-2019-10083

When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents at the top most level, not recursively. The response included details about processors and controller services which the user may not have had read access to...