PT-2025-11109 · Apache · Apache Nifi

Robert Creese · Published 2025-03-11 · Updated 2025-07-16 · CVE-2025-27017

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:L/U:Green

Name of the Vulnerable Software and Affected Versions: Apache NiFi versions 1.13.0 through 2.2.0

Description: The issue concerns the inclusion of sensitive authentication credentials, specifically the username and password used to connect to MongoDB, in the NiFi provenance events generated by MongoDB components during processing. An authorized user with read access to these events may be able to view the credentials.

Recommendations: For Apache NiFi versions 1.13.0 through 2.2.0, upgrade to Apache NiFi 2.3.0 to remove the credentials from provenance event records.

Fix

Weakness Enumeration

CWE-538

Related Identifiers

BDU:2025-02796

CVE-2025-27017

GHSA-35GQ-CVRM-XF94

Affected Products

Apache Nifi

References · 21

• https://osv.dev/vulnerability/GHSA-35gq-cvrm-xf94 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27017 · Security Note
• https://bdu.fstec.ru/vul/2025-02796 · Security Note
• https://lists.apache.org/thread/d4n5474jkhp82dvnht13pjtlfx7bhn5q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27017 · Vendor Advisory
• https://github.com/apache/nifi · Note
• https://github.com/apache/nifi/commit/48d684500f6ad70f65bfd510db054590c5bc74a9 · Note
• https://twitter.com/the_yellow_fall/status/1900004081382678865 · Twitter Post
• https://t.me/cvenotify/129170 · Telegram Post
• https://twitter.com/TweetThreatNews/status/1900138396812550465 · Twitter Post
• https://t.me/pentestingnews/57809 · Telegram Post
• https://twitter.com/MalwarePatrol/status/1900652153397465092 · Twitter Post
• https://t.me/cvedetector/20146 · Telegram Post
• https://twitter.com/CVEnew/status/1899894889799966876 · Twitter Post
• http://openwall.com/lists/oss-security/2025/03/11/1 · Note