org.apache.nifi:nifi-web-api@0.1.0-incubating
latest version
2.10.0
latest non vulnerable version
first published
11 years ago
latest version published
23 days ago
licenses detected
- [0.0.1-incubating,)
package registry
Direct Vulnerabilities
Known vulnerabilities in the org.apache.nifi:nifi-web-api package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.apache.nifi:nifi-web-api is a system to process and distribute data. Affected versions of this package are vulnerable to Incorrect Authorization while configuring verification requests. An attacker can override existing configuration properties by submitting alternative settings through read access, which enables invoking predefined verification methods with unauthorized parameters. Note: This is only exploitable if the system does not enforce separate authorization levels for viewing and modifying component configuration. How to fix Incorrect Authorization? Upgrade | [,2.10.0) |
org.apache.nifi:nifi-web-api is a system to process and distribute data. Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to restricted components by submitting requests to replace Process Groups without proper authorization checks. Note: This is only exploitable if the installation does not implement specific authorization for Restricted components. How to fix Missing Authorization? Upgrade | [,2.10.0) |
Apache NiFi is a system to process and distribute data. Affected versions of this package are vulnerable to Deserialization of Untrusted Data. Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release. How to fix Deserialization of Untrusted Data? Upgrade | [,1.4.0) |