PT-2020-20697 · Apache · Apache Nifi

Published 2020-10-01 · Updated 2025-09-12 · CVE-2020-9487

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.0.0 through 1.11.4

Description The issue concerns the NiFi download token mechanism, which uses a fixed cache size and does not authenticate requests to create download tokens. This allows an unauthenticated user to repeatedly request download tokens, thereby preventing legitimate users from doing so.

Recommendations For Apache NiFi versions 1.0.0 through 1.11.4, consider restricting access to the download token creation mechanism to authenticated users as a temporary workaround until a patch is available. Additionally, monitor the download token request rate to detect and prevent potential abuse. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BIT-NIFI-2020-9487

CVE-2020-9487

GHSA-3PP3-77J6-8PH6

Affected Products

Apache Nifi

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-9487 · Security Note
• https://osv.dev/vulnerability/BIT-nifi-2020-9487 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9487 · Vendor Advisory
• https://nifi.apache.org/security#CVE-2020-9487 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3pp3-77j6-8ph6 · Vendor Advisory
• https://github.com/apache/nifi/commit/01e42dfb3291c3a3549023edadafd2d8023f3042 · Note