CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2025-27017 – Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record
https://notcve.org/view.php?id=CVE-2025-27017
12 Mar 2025 — Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials information. Upgrading to Apache NiFi 2.3.0 is the recommended mitigation, which removes the credentials from provenance event records. • https://lists.apache.org/thread/d4n5474jkhp82dvnht13pjtlfx7bhn5q • CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory •
CVSS: 5.5EPSS: 29%CPEs: 1EXPL: 1CVE-2024-56512 – Apache NiFi: Missing Complete Authorization for Parameter and Service References
https://notcve.org/view.php?id=CVE-2024-56512
28 Dec 2024 — Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases where the Process Group did not reference any Parameter values, the framework did not check user authorization for the bound Parameter Context. Missing authorization for a bound Parameter Context enabled clients to down... • https://github.com/absholi7ly/CVE-2024-56512-Apache-NiFi-Exploit • CWE-638: Not Using Complete Mediation •
CVSS: 6.9EPSS: 0%CPEs: 2EXPL: 0CVE-2024-52067 – Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log
https://notcve.org/view.php?id=CVE-2024-52067
21 Nov 2024 — Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causing the application to write Parameter names and values to the application log. Parameter Context values may contain sensitive information depending on application flow configuration. Deployments of Apache NiFi with ... • https://lists.apache.org/thread/9rz5rwn2zc7pfjq7ppqldqlc067tlcwd • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-45477 – Apache NiFi: Improper Neutralization of Input in Parameter Description
https://notcve.org/view.php?id=CVE-2024-45477
29 Oct 2024 — Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.28.0 or 2.0.0-M4 is the recommended mitigation. Apache NiFi 1.10.0 a 1.27.0 y 2.0.0-M1 a 2.0.0-M3 ad... • https://lists.apache.org/thread/shdv0tw9hggj7tx9pl7g93mgok2lwbj9 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •