PT-2024-35118 · Apache · Apache Nifi

David Handermann · Published 2024-11-20 · Updated 2025-02-11 · CVE-2024-52067

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/AU:Y/R:U/V:D/RE:L/U:Green

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.16.0 through 1.28.0 Apache NiFi versions 2.0.0-M1 through 2.0.0-M4

Description The issue concerns the optional debug logging of Parameter Context values during the flow synchronization process in Apache NiFi. An authorized administrator with access to change logging levels could enable debug logging, causing the application to write Parameter names and values to the application log. Parameter Context values may contain sensitive information depending on the application flow configuration. Deployments with the default Logback configuration do not log Parameter Context values.

Recommendations For Apache NiFi versions 1.16.0 through 1.28.0, upgrade to Apache NiFi 1.28.1 to eliminate Parameter value logging from the flow synchronization process. For Apache NiFi versions 2.0.0-M1 through 2.0.0-M4, upgrade to Apache NiFi 2.0.0 to eliminate Parameter value logging from the flow synchronization process.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2025-02251

CVE-2024-52067

GHSA-V3VC-6QCV-4VRX

Affected Products

Apache Nifi

References · 20

• https://osv.dev/vulnerability/GHSA-v3vc-6qcv-4vrx · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-52067 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52067 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02251 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-52067 · Security Note
• https://lists.apache.org/thread/9rz5rwn2zc7pfjq7ppqldqlc067tlcwd · Vendor Advisory
• https://github.com/apache/nifi · Note
• https://github.com/apache/nifi/commit/5aed878c5d2a193cd2039c2e997bc3025046bc41 · Note
• https://github.com/apache/nifi/commit/c1108365949268631526d5016b1a163a82f8e9df · Note
• https://t.me/pentestingnews/53507 · Telegram Post
• https://issues.apache.org/jira/browse/NIFI-13971 · Note
• https://nifi.apache.org · Note
• https://twitter.com/VulmonFeeds/status/1859357329776402803 · Twitter Post
• https://twitter.com/CVEnew/status/1859601785926844435 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1859773174373810400 · Twitter Post