PT-2020-15179 · Apache · Apache Nifi

Andy Lopresto · Published 2020-02-11 · Updated 2025-09-12 · CVE-2020-1942

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 0.0.1 through 1.11.0

Description The issue concerns the flow fingerprint factory in Apache NiFi, which generated flow fingerprints that included sensitive property descriptor values. When a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprints of both the cluster and local flow were printed, potentially exposing sensitive values in plaintext.

Recommendations For Apache NiFi versions 0.0.1 through 1.11.0, consider restricting access to the flow fingerprint factory to minimize the risk of sensitive information exposure until a fix is available.

Fix

Insertion into Log File

Information Disclosure

Weakness Enumeration

CWE-532

CWE-200

Related Identifiers

BIT-NIFI-2020-1942

CVE-2020-1942

GHSA-7Q8G-GPFP-V8GX

Affected Products

Apache Nifi

References · 9

• https://osv.dev/vulnerability/GHSA-7q8g-gpfp-v8gx · Vendor Advisory
• https://nifi.apache.org/security.html#CVE-2020-1942 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nifi-2020-1942 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1942 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1942 · Vendor Advisory
• https://github.com/apache/nifi/commit/d7c29f46378379fb596e4d1e59d1a3c41063db5b · Note
• https://github.com/apache/nifi/commit/95746d346cddbd6134c4b28fdc39d5813a626f97 · Note
• https://github.com/apache/nifi/pull/4028 · Note
• https://issues.apache.org/jira/browse/NIFI-7079 · Note