org.apache.nifi:nifi-framework-nar (>=1.1.0 <=1.12.1), org.apache.nifi:nifi-jetty (>=1.1.0 <=1.15.3) +2 more potentially affected by CVE-2024-45477 via org.apache.nifi:nifi-web-ui (>=1.10.0 <=1.27.0)

org.apache.nifi:nifi-web-ui MAVEN version =1.10.0, =1.1.0, =1.1.0, =1.13.0, =1.11.0, =1.27.0 Source cves: CVE-2024-45477 Source advisory: OSV:GHSA-7MQJ-XGF8-P59V...

org.apache.nifi.minifi:minifi-framework-core (=0.0.1), org.apache.nifi.minifi:minifi-framework-nar (=0.0.1) +16 more potentially affected by CVE-2020-1942 via org.apache.nifi:nifi-framework-core (>=0.0.2-incubating <=1.11.4)

org.apache.nifi:nifi-framework-core MAVEN version =0.0.2-incubating, =1.0.0, =0.0.2-incubating, =1.0.0, =0.0.2-incubating, =0.0.2-incubating, =0.0.2-incubating, =1.11.0, =1.10.0, =1.10.0, =1.10.0, =1.11.4 and more Source cves: CVE-2020-1942 Source advisory: OSV:GHSA-7Q8G-GPFP-V8GX...

External Resource Load

nifi-jetty is vulnerable to malicious external resource loads. Using a malicious HOST header, attackers can load malicious resources from external sources...

Cross-site Scripting (XSS)

nifi-jetty is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary JavaScript because the library does have the sufficient response headers to only allow framing from the same origin...