GitHub Advisoryadvisory · Maven

GHSA-w4fj-ccr6-7pcp Apache NiFi Insertion of Sensitive Information into Log File

MEDIUM Published 2022-01-06 Modified 2023-09-25 Official page ↗
Aliases
CVE-2020-1928
Ecosystem
Maven
Packages
org.apache.nifi:nifi-parameter
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-532
Reviewed
2021-03-29

Affected packages

• Maven org.apache.nifi:nifi-parameter: >= 1.10.0, < 1.11.0 → fixed in 1.11.0

Description

An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.

Related

Alias · CVE (1)

  • CVE-2020-1928 An information disclosure vulnerability was found in Apache NiFi 1.10.0. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-532 Insertion of Sensitive Information into Log File weakness

References