PT-2023-8006 · Apache · Apache Nifi

Dr. Oliver Matula · Published 2023-11-22 · Updated 2025-09-12 · CVE-2023-49145

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 0.7.0 through 1.23.2

Description The issue is related to the JoltTransformJSON Processor in Apache NiFi, which provides an advanced configuration user interface vulnerable to DOM-based cross-site scripting. If an authenticated user visits a crafted URL, arbitrary JavaScript code can be executed within the session context of the authenticated user.

Recommendations For Apache NiFi versions 0.7.0 through 1.23.2, upgrade to Apache NiFi 1.24.0 or 2.0.0-M1 to mitigate the issue. As a temporary workaround, consider restricting access to the JoltTransformJSON Processor for authenticated users until the upgrade is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-09120

BIT-NIFI-2023-49145

CVE-2023-49145

GHSA-68PR-6FJC-WMGM

Affected Products

Apache Nifi

References · 13

• https://nifi.apache.org/security.html#CVE-2023-49145 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-68pr-6fjc-wmgm · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nifi-2023-49145 · Vendor Advisory
• https://lists.apache.org/thread/j8rd0qsvgoj0khqck5f49jfbp0fm8r1o · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49145 · Security Note
• https://bdu.fstec.ru/vul/2023-09120 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49145 · Vendor Advisory
• https://github.com/apache/nifi · Note
• https://github.com/apache/nifi/pull/8060 · Note
• https://github.com/apache/nifi/commit/50efc55df6bb00ea15adcc2459d5cc82d128857f · Note
• https://issues.apache.org/jira/browse/NIFI-12403 · Note
• https://t.me/cvenotify/61288 · Telegram Post
• http://openwall.com/lists/oss-security/2023/11/27/5 · Note