CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-1942
https://notcve.org/view.php?id=CVE-2020-1942
In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was printed, potentially containing sensitive values in plaintext. En Apache NiFi versiones 0.0.1 hasta 1.11.0, la fabrica de huella digitales de flujo generaba huellas digitales de flujo que incluían valores de descriptores de propiedades confidenciales. En el caso de que un nodo intentara unirse a un clúster y el flujo del clúster no fuera heredable, la huella digital de flujo del clúster y del flujo local fue impresa, lo que potencialmente contenía valores confidenciales en texto plano. • https://nifi.apache.org/security.html#CVE-2020-1942 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1309
https://notcve.org/view.php?id=CVE-2018-1309
Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release. Hay un problema de XEE (XML External Entity) en el procesador SplitXML en Apache NiFi. • https://nifi.apache.org/security.html#CVE-2018-1309 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1310
https://notcve.org/view.php?id=CVE-2018-1310
Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial of service. See ActiveMQ CVE-2015-5254 announcement for more information. The fix to upgrade the activemq-client library to 5.15.3 was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release. • https://nifi.apache.org/security.html#CVE-2018-1310 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12632
https://notcve.org/view.php?id=CVE-2017-12632
A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to a controlled whitelist was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release. Una cabecera de host manipulada en una petición HTTP entrante podría provocar que NiFi cargue recursos de un servidor externo. La solución para sanear cabeceras de host y compararlas con una lista blanca controlada se aplicó en la versión 1.5.0 de Apache NiFi. • https://nifi.apache.org/security.html#CVE-2017-12632 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2017-5635
https://notcve.org/view.php?id=CVE-2017-5635
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user. En Apache NiFi, en versiones anteriores a la 0.7.2 y versiones 1.x, anteriores a la 1.1.2, en un entorno de clúster, si se copia la petición de un usuario anónimo a otro nodo, se utiliza la identidad del nodo que la originó en lugar de la del usuario "anónimo". • http://www.securityfocus.com/bid/96730 https://nifi.apache.org/security.html#CVE-2017-5635 • CWE-287: Improper Authentication •