PT-2019-11423 · Apache · Apache Nifi

Mark Payne · Publicado 2019-11-19 · Atualizado 2020-01-24 · CVE-2019-10083

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache NiFi versions 1.3.0 through 1.9.2

Description: The issue allows unauthorized access to sensitive information when updating a Process Group via the API. The response to the request includes details about processors and controller services, which the user may not have had read access to.

Recommendations: For Apache NiFi versions 1.3.0 through 1.9.2, consider restricting access to the API endpoint used for updating Process Groups until a fix is available. As a temporary workaround, limit the information included in the response to only what is necessary for the user's role, or apply access controls to sensitive details about processors and controller services.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2019-10083

GHSA-26P8-XRJ2-MV53

Produtos afetados

Apache Nifi

Referências · 6

• https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10083 · Nota de Segurança
• https://nifi.apache.org/security.html#CVE-2019-10083 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-26p8-xrj2-mv53 · Aviso do Fabricante
• https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2019-10083 · Aviso do Fabricante