org.apache.nifi:nifi-server-nar (2.0.0-m3), org.apache.nifi:nifi-system-test-suite (>=2.0.0-m1, <=2.0.0-m3) potentially affected by CVE-2024-37389 via org.apache.nifi:nifi-web-ui (>=2.0.0-m1, <=2.0.0-m3)

org.apache.nifi:nifi-web-ui MAVEN version =2.0.0-m1, =2.0.0-m1, =2.0.0-m3 Source cves: CVE-2024-37389 Source advisory: OSV:GHSA-H658-QQV9-QWV8...

org.apache.nifi:nifi-framework-nar (>=1.10.0, <=1.12.1), org.apache.nifi:nifi-jetty (>=1.10.0, <=1.15.3) +2 more potentially affected by CVE-2024-37389 via org.apache.nifi:nifi-web-ui (>=1.10.0, <=1.26.0)

org.apache.nifi:nifi-web-ui MAVEN version =1.10.0, =1.10.0, =1.10.0, =1.13.0, =1.11.0, =1.26.0 Source cves: CVE-2024-37389 Source advisory: GHSA-H658-QQV9-QWV8...

Cross-site Scripting (XSS)

nifi-web-ui is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary JavaScript due to the library insufficient validation on user input when creating SlickGrid tables...