PT-2019-12795 · Apache · Nifi

Abdu Sahin · Published 2019-11-19 · Updated 2020-01-24 · CVE-2019-12421

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NiFi versions 1.0.0 through 1.9.2

Description The issue occurs when using an authentication mechanism other than PKI. After a user clicks Log Out, NiFi invalidates the authentication token on the client side but fails to do so on the server side. This allows the client-side token to be used for up to 12 hours after logging out, enabling unauthorized API requests to NiFi.

Recommendations For NiFi versions 1.0.0 through 1.9.2, consider implementing a server-side token invalidation mechanism to prevent unauthorized access after a user logs out. As a temporary workaround, restrict API requests from clients that have logged out to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2019-12421

GHSA-FMQW-VQH5-CWQ9

Affected Products

Nifi

References · 8

• https://osv.dev/vulnerability/GHSA-fmqw-vqh5-cwq9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12421 · Vendor Advisory
• https://nifi.apache.org/security.html#CVE-2019-12421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12421 · Security Note
• https://github.com/apache/nifi/commit/cf6f5172503ce438c6c22c334c9367f774db7b24 · Note
• https://github.com/apache/nifi/pull/3362 · Note
• https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E · Note
• https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E · Note