PT-2024-31656 · Apache · Apache Nifi

Muhammad Hazim Bin Nor Aizi · Published 2024-10-29 · Updated 2026-04-13 · CVE-2024-45477

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: Apache NiFi versions 1.10.0 through 1.27.0 Apache NiFi versions 2.0.0-M1 through 2.0.0-M3

Description: The vulnerability allows an authenticated user, authorized to configure a Parameter Context, to enter arbitrary JavaScript code in the description field for Parameters. This code will be executed by the client browser within the session context of the authenticated user, enabling cross-site scripting attacks.

Recommendations: For Apache NiFi versions 1.10.0 through 1.27.0, upgrade to Apache NiFi 1.28.0. For Apache NiFi versions 2.0.0-M1 through 2.0.0-M3, upgrade to Apache NiFi 2.0.0-M4.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-NIFI-2024-45477

CVE-2024-45477

GHSA-7MQJ-XGF8-P59V

Affected Products

Apache Nifi

References · 16

• https://osv.dev/vulnerability/GHSA-7mqj-xgf8-p59v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45477 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nifi-2024-45477 · Vendor Advisory
• https://lists.apache.org/thread/shdv0tw9hggj7tx9pl7g93mgok2lwbj9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45477 · Security Note
• https://github.com/apache/nifi · Note
• https://github.com/apache/nifi/blob/rel/nifi-1.27.0/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/canvas/nf-parameter-contexts.js#L2197 · Note
• https://github.com/apache/nifi/commit/153c87a7daaeebea9b119066285b840ea4056e09 · Note
• https://github.com/apache/nifi/pull/9195 · Note
• https://t.me/cvenotify/101062 · Telegram Post
• https://t.me/cvenotify/99830 · Telegram Post
• https://t.me/cvedetector/9271 · Telegram Post
• https://issues.apache.org/jira/browse/NIFI-13675 · Note
• https://twitter.com/Hossted_OSS/status/1853364078342733986 · Twitter Post
• http://openwall.com/lists/oss-security/2024/10/28/1 · Note