it.agilelab:wasp-spark-nifi-plugin-bridge_2.11 (>=2.27.2 <=2.36.0-cdp719), it.agilelab:wasp-spark-nifi-plugin-bridge_2.12 (>=0.0.0 <=3.1.0-3_5_emr770) +2 more potentially affected by CVE-2020-9486 via org.apache.nifi:nifi-stateless (>=1.10.0 <=1.11.4)

org.apache.nifi:nifi-stateless MAVEN version =1.10.0, =2.27.2, =0.0.0, =1.10.0, =1.11.0, =1.11.4 Source cves: CVE-2020-9486 Source advisory: OSV:GHSA-G644-PR5V-VPPF...

CVE-2020-9486

CVE-2020-9486 affects Apache NiFi 1.10.0–1.11.4, where the stateless execution engine logs a flow definition configuration JSON during trigger, potentially revealing sensitive property values in plaintext. The vulnerability, described as information disclosure, is evidenced by multiple sources (N...

CVE-2020-9486

In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext...