org.apache.nifi:nifi-framework-cluster@0.2.0-incubating
latest version
2.11.0
latest non vulnerable version
first published
11 years ago
latest version published
6 days ago
licenses detected
- [0.0.1-incubating,)
package registry
Direct Vulnerabilities
Known vulnerabilities in the org.apache.nifi:nifi-framework-cluster package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.apache.nifi:nifi-framework-cluster is a clustering software for NiFi. Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to restricted components by submitting requests to replace Process Groups without proper authorization checks. Note: This is only exploitable if the installation does not implement specific authorization for Restricted components. How to fix Missing Authorization? Upgrade | [,2.10.0) |
Apache NiFi is a system to process and distribute data. Affected versions of this package are vulnerable to Deserialization of Untrusted Data. Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release. How to fix Deserialization of Untrusted Data? Upgrade | [,1.4.0) |