GitHub Advisoryadvisory · Maven

GHSA-26p8-xrj2-mv53 Apache NiFi process group information disclosure

MEDIUM Published 2019-12-02 Modified 2021-08-19 Official page ↗
Aliases
CVE-2019-10083
Ecosystem
Maven
Packages
org.apache.nifi:nifi-web-api, org.apache.nifi:nifi
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2019-12-02

Affected packages

• Maven org.apache.nifi:nifi-web-api: >= 1.3.0, < 1.10.0 → fixed in 1.10.0 • Maven org.apache.nifi:nifi: >= 1.3.0, < 1.10.0 → fixed in 1.10.0

Description

When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.

Related

Alias · CVE (1)

  • CVE-2019-10083 When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References