GitHub Advisoryadvisory · Maven

GHSA-35gq-cvrm-xf94 Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record

MEDIUM Published 2025-03-12 Modified 2025-07-16 Official page ↗
Aliases
CVE-2025-27017
Ecosystem
Maven
Packages
org.apache.nifi:nifi-mongodb-services
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-538
Reviewed
2025-03-12

Affected packages

• Maven org.apache.nifi:nifi-mongodb-services: >= 1.13.0, < 2.3.0 → fixed in 2.3.0

Description

Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials information. Upgrading to Apache NiFi 2.3.0 is the recommended mitigation, which removes the credentials from provenance event records.

Related

Alias · CVE (1)

  • CVE-2025-27017 Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that… vulnerability

Weakness · CWE (1)

  • CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory weakness

References