PT-2024-10215 · Apache · Apache Nifi

Matt Gilman · Published 2024-12-26 · Updated 2025-09-12 · CVE-2024-56512

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.10.0 through 2.0.0

Description The issue is related to missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers when creating new Process Groups. This allows clients to download non-sensitive Parameter values after creating the Process Group and enables clients to create Process Groups and use these components that were otherwise unauthorized. The scope is limited to authenticated users authorized to create Process Groups and deployments with component-based authorization policies.

Recommendations Upgrading to Apache NiFi 2.1.0 is the recommended mitigation, which includes authorization checking for Parameter and Controller Service references on Process Group creation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-638

Related Identifiers

BDU:2025-00545

BIT-NIFI-2024-56512

CVE-2024-56512

GHSA-MPJ7-7MG7-X95J

Affected Products

Apache Nifi

References · 23

• https://osv.dev/vulnerability/GHSA-mpj7-7mg7-x95j · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nifi-2024-56512 · Vendor Advisory
• https://lists.apache.org/thread/cjc8fns5kjsho0s7vonlnojokyfx47wn · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00545 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-56512 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56512 · Vendor Advisory
• https://github.com/apache/nifi · Note
• https://github.com/apache/nifi/commit/f744deebf9a9effdbbff79ce6073ec329b5f45da · Note
• https://twitter.com/fofabot/status/1876468538757788083 · Twitter Post
• https://t.me/pentestingnews/54730 · Telegram Post
• https://twitter.com/Dinosn/status/1873586424949481665 · Twitter Post
• https://t.me/cvedetector/13847 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1873554856985927771 · Twitter Post
• http://openwall.com/lists/oss-security/2024/12/28/1 · Note
• https://vuldb.com/?id.289658 · Note