PT-2020-20696 · Apache · Apache Nifi

Published 2020-10-01 · Updated 2025-09-12 · CVE-2020-9486

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.10.0 through 1.11.4

Description The issue concerns the NiFi stateless execution engine producing log output that includes sensitive property values. When a flow is triggered, the flow definition configuration JSON is printed, potentially containing sensitive values in plaintext.

Recommendations For Apache NiFi versions 1.10.0 through 1.11.4, consider disabling the logging of flow definition configuration JSON to prevent sensitive values from being printed in plaintext. Restrict access to the log output to minimize the risk of sensitive information exposure.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BIT-NIFI-2020-9486

CVE-2020-9486

GHSA-G644-PR5V-VPPF

Affected Products

Apache Nifi

References · 8

• https://osv.dev/vulnerability/CVE-2020-9486 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9486 · Security Note
• https://osv.dev/vulnerability/GHSA-g644-pr5v-vppf · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nifi-2020-9486 · Vendor Advisory
• https://nifi.apache.org/security#CVE-2020-9486 · Vendor Advisory
• https://github.com/apache/nifi · Note
• https://github.com/apache/nifi/commit/148537d64a017b73160b0d49943183c18f883ab0 · Note
• https://t.me/cibsecurity/15005 · Telegram Post