PT-2020-15172 · Apache · Apache Nifi

Andy Lopresto · Published 2020-01-28 · Updated 2025-09-12 · CVE-2020-1928

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi version 1.10.0

Description An information disclosure issue was found in the sensitive parameter parser, which would log parsed values for debugging purposes. This exposes literal values entered in a sensitive property when no parameter is present.

Recommendations For Apache NiFi version 1.10.0, consider disabling the sensitive parameter parser's debugging logging to prevent exposure of sensitive information. Restrict access to the logs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Insertion into Log File

Weakness Enumeration

CWE-200

CWE-532

Related Identifiers

BIT-NIFI-2020-1928

CVE-2020-1928

GHSA-W4FJ-CCR6-7PCP

Affected Products

Apache Nifi

References · 15

• https://osv.dev/vulnerability/CVE-2020-1928 · Vendor Advisory
• https://nifi.apache.org/security.html#CVE-2020-1928 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1928 · Security Note
• https://osv.dev/vulnerability/BIT-nifi-2020-1928 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w4fj-ccr6-7pcp · Vendor Advisory
• https://github.com/apache/nifi · Note
• https://github.com/apache/nifi/commit/42cb6e84898e66672878f61f99543d6af3c0a567 · Note
• https://github.com/apache/nifi/pull/3935 · Note
• https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1%40%3Cusers.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b@%3Cusers.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b%40%3Cusers.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e%40%3Cusers.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1@%3Cusers.tomcat.apache.org%3E · Note
• https://t.me/cvenotify/503 · Telegram Post
• https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e@%3Cusers.tomcat.apache.org%3E · Note