PT-2023-8006 · Apache · Apache Nifi

Dr. Oliver Matula · Publicado 2023-11-22 · Atualizado 2025-09-12 · CVE-2023-49145

Positive Technologies (AI Summary)

CVSS v3.1

7.9

Alta

Vetor base

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 0.7.0 through 1.23.2

Description The issue is related to the JoltTransformJSON Processor in Apache NiFi, which provides an advanced configuration user interface vulnerable to DOM-based cross-site scripting. If an authenticated user visits a crafted URL, arbitrary JavaScript code can be executed within the session context of the authenticated user.

Recommendations For Apache NiFi versions 0.7.0 through 1.23.2, upgrade to Apache NiFi 1.24.0 or 2.0.0-M1 to mitigate the issue. As a temporary workaround, consider restricting access to the JoltTransformJSON Processor for authenticated users until the upgrade is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2023-09120

BIT-NIFI-2023-49145

CVE-2023-49145

GHSA-68PR-6FJC-WMGM

Produtos afetados

Apache Nifi

Referências · 13

• https://github.com/apache/nifi · Nota
• https://github.com/apache/nifi/pull/8060 · Nota
• https://github.com/apache/nifi/commit/50efc55df6bb00ea15adcc2459d5cc82d128857f · Nota
• https://nifi.apache.org/security.html#CVE-2023-49145 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-68pr-6fjc-wmgm · Aviso do Fabricante
• https://issues.apache.org/jira/browse/NIFI-12403 · Nota
• https://osv.dev/vulnerability/BIT-nifi-2023-49145 · Aviso do Fabricante
• https://lists.apache.org/thread/j8rd0qsvgoj0khqck5f49jfbp0fm8r1o · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-49145 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-09120 · Nota de Segurança
• https://t.me/cvenotify/61288 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2023/11/27/5 · Nota
• https://osv.dev/vulnerability/CVE-2023-49145 · Aviso do Fabricante