CVSS: 5.4EPSS: 0%CPEs: 15EXPL: 0CVE-2024-37389 – Apache NiFi: Improper Neutralization of Input in Parameter Context Description
https://notcve.org/view.php?id=CVE-2024-37389
Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation. Apache NiFi 1.10.0 a 1.26.0 y 2.0.0-M1 a 2.0.0-M3 admiten un campo de descripción en la configuración del contexto de parámetros que es vulnerable a Cross site Scripting. Un usuario autenticado, autorizado para configurar un contexto de parámetro, puede ingresar código JavaScript arbitrario, que el navegador del cliente ejecutará dentro del contexto de sesión del usuario autenticado. • https://lists.apache.org/thread/yso9fr0wtff53nk046h1o83hdyb1lrxh • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49145 – Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt
https://notcve.org/view.php?id=CVE-2023-49145
Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0-M1 is the recommended mitigation. Apache NiFi 0.7.0 a 1.23.2 incluye el procesador JoltTransformJSON, que proporciona una interfaz de usuario de configuración avanzada que es vulnerable a Cross Site Scripting basado en DOM. Si un usuario autenticado, que está autorizado a configurar un procesador JoltTransformJSON, visita una URL manipulada, entonces se puede ejecutar código JavaScript arbitrario dentro del contexto de sesión del usuario autenticado. • http://www.openwall.com/lists/oss-security/2023/11/27/5 https://lists.apache.org/thread/j8rd0qsvgoj0khqck5f49jfbp0fm8r1o https://nifi.apache.org/security.html#CVE-2023-49145 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-40037 – Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs
https://notcve.org/view.php?id=CVE-2023-40037
Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation. Apache NiFi 1.21.0 hasta 1.23.0 soportan accesos JDBC y JNDI JMS en varios procesadores y servicios de controlador con validación de URL de conexión que no proporciona suficiente protección contra entradas manipuladas. • https://github.com/mbadanoiu/CVE-2023-40037 http://www.openwall.com/lists/oss-security/2023/08/18/2 https://lists.apache.org/thread/bqbjlrs2p5ghh8sbk5nsxb8xpf9l687q https://nifi.apache.org/security.html#CVE-2023-40037 • CWE-184: Incomplete List of Disallowed Inputs CWE-697: Incorrect Comparison •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-36542 – Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources
https://notcve.org/view.php?id=CVE-2023-36542
Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation. • http://seclists.org/fulldisclosure/2023/Jul/43 http://www.openwall.com/lists/oss-security/2023/07/29/1 https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof https://nifi.apache.org/security.html#CVE-2023-36542 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-34212 – Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components
https://notcve.org/view.php?id=CVE-2023-34212
The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes. You are recommended to upgrade to version 1.22.0 or later which fixes this issue. • https://github.com/mbadanoiu/CVE-2023-34212 http://www.openwall.com/lists/oss-security/2023/06/12/2 https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5 https://nifi.apache.org/security.html#CVE-2023-34212 • CWE-502: Deserialization of Untrusted Data •