CVSS: 5.4EPSS: 0%CPEs: 15EXPL: 0CVE-2024-37389 – Apache NiFi: Improper Neutralization of Input in Parameter Context Description
https://notcve.org/view.php?id=CVE-2024-37389
Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation. Apache NiFi 1.10.0 a 1.26.0 y 2.0.0-M1 a 2.0.0-M3 admiten un campo de descripción en la configuración del contexto de parámetros que es vulnerable a Cross site Scripting. Un usuario autenticado, autorizado para configurar un contexto de parámetro, puede ingresar código JavaScript arbitrario, que el navegador del cliente ejecutará dentro del contexto de sesión del usuario autenticado. • https://lists.apache.org/thread/yso9fr0wtff53nk046h1o83hdyb1lrxh • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49145 – Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt
https://notcve.org/view.php?id=CVE-2023-49145
Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0-M1 is the recommended mitigation. Apache NiFi 0.7.0 a 1.23.2 incluye el procesador JoltTransformJSON, que proporciona una interfaz de usuario de configuración avanzada que es vulnerable a Cross Site Scripting basado en DOM. Si un usuario autenticado, que está autorizado a configurar un procesador JoltTransformJSON, visita una URL manipulada, entonces se puede ejecutar código JavaScript arbitrario dentro del contexto de sesión del usuario autenticado. • http://www.openwall.com/lists/oss-security/2023/11/27/5 https://lists.apache.org/thread/j8rd0qsvgoj0khqck5f49jfbp0fm8r1o https://nifi.apache.org/security.html#CVE-2023-49145 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41180 – Apache NiFi MiNiFi C++: Incorrect Certificate Validation in InvokeHTTP for MiNiFi C++
https://notcve.org/view.php?id=CVE-2023-41180
Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default, when using HTTPS. Mitigation: Set the Disable Peer Verification property of InvokeHTTP to true when using MiNiFi C++ versions 0.13.0 or 0.14.0. Upgrading to MiNiFi C++ 0.15.0 corrects the default behavior. validación incorrecta de certificados en nvokeHTTP sobre Apache NiFi MiNiFi C++ versions 0.13 to 0.14 permite a un intermediario presentar un certificado falsificado durante la negociación del apretón de manos TLS. La propiedad Disable Peer Verification de InvokeHTTP se invirtió de forma efectiva, deshabilitando la verificación por defecto, cuando se utiliza HTTPS. Mitigación: Establezca la propiedad Disable Peer Verification de InvokeHTTP en true cuando utilice las versiones 0.13.0 o 0.14.0 de MiNiFi C++. • https://lists.apache.org/thread/b51f8csysg1pvgs6xjjrq5hrjrvfot1y • CWE-295: Improper Certificate Validation •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-40037 – Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs
https://notcve.org/view.php?id=CVE-2023-40037
Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation. Apache NiFi 1.21.0 hasta 1.23.0 soportan accesos JDBC y JNDI JMS en varios procesadores y servicios de controlador con validación de URL de conexión que no proporciona suficiente protección contra entradas manipuladas. • https://github.com/mbadanoiu/CVE-2023-40037 http://www.openwall.com/lists/oss-security/2023/08/18/2 https://lists.apache.org/thread/bqbjlrs2p5ghh8sbk5nsxb8xpf9l687q https://nifi.apache.org/security.html#CVE-2023-40037 • CWE-184: Incomplete List of Disallowed Inputs CWE-697: Incorrect Comparison •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-36542 – Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources
https://notcve.org/view.php?id=CVE-2023-36542
Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation. • http://seclists.org/fulldisclosure/2023/Jul/43 http://www.openwall.com/lists/oss-security/2023/07/29/1 https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof https://nifi.apache.org/security.html#CVE-2023-36542 • CWE-94: Improper Control of Generation of Code ('Code Injection') •