PT-2019-11423 · Apache · Apache Nifi

Mark Payne · Published 2019-11-19 · Updated 2020-01-24 · CVE-2019-10083

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache NiFi versions 1.3.0 through 1.9.2

Description: The issue allows unauthorized access to sensitive information when updating a Process Group via the API. The response to the request includes details about processors and controller services, which the user may not have had read access to.

Recommendations: For Apache NiFi versions 1.3.0 through 1.9.2, consider restricting access to the API endpoint used for updating Process Groups until a fix is available. As a temporary workaround, limit the information included in the response to only what is necessary for the user's role, or apply access controls to sensitive details about processors and controller services.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-10083

GHSA-26P8-XRJ2-MV53

Affected Products

Apache Nifi

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-10083 · Security Note
• https://nifi.apache.org/security.html#CVE-2019-10083 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-26p8-xrj2-mv53 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10083 · Vendor Advisory
• https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E · Note
• https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E · Note