org.apache.nifi:nifi-framework-nar (>=1.1.0 <=1.12.1), org.apache.nifi:nifi-jetty (>=1.1.0 <=1.15.3) +2 more potentially affected by CVE-2024-45477 via org.apache.nifi:nifi-web-ui (>=1.10.0 <=1.27.0)

org.apache.nifi:nifi-web-ui MAVEN version =1.10.0, =1.1.0, =1.1.0, =1.13.0, =1.11.0, =1.27.0 Source cves: CVE-2024-45477 Source advisory: OSV:GHSA-7MQJ-XGF8-P59V...

org.apache.nifi:nifi-server-nar (=2.0.0-M3), org.apache.nifi:nifi-system-test-suite (>=2.0.0-M1 <=2.0.0-M3) potentially affected by CVE-2024-37389 via org.apache.nifi:nifi-web-ui (>=2.0.0-M1 <=2.0.0-M3)

org.apache.nifi:nifi-web-ui MAVEN version =2.0.0-M1, =2.0.0-M1, =2.0.0-M3 Source cves: CVE-2024-37389 Source advisory: OSV:GHSA-H658-QQV9-QWV8...

Cross-site Scripting (XSS)

nifi-web-ui is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary JavaScript due to the library insufficient validation on user input when creating SlickGrid tables...