org.apache.nifi:nifi-web-api@1.1.0 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.apache.nifi:nifi-web-api package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Scripting (XSS)

org.apache.nifi:nifi-web-api is a system to process and distribute data.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. This vulnerability is not exploitable via other browsers.

How to fix Cross-site Scripting (XSS)?

Upgrade org.apache.nifi:nifi-web-api to version 1.11.0 or higher.

[1.0.0,1.11.0)
  • M
Information Exposure

org.apache.nifi:nifi-web-api is a system to process and distribute data.

Affected versions of this package are vulnerable to Information Exposure. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.

How to fix Information Exposure?

Upgrade org.apache.nifi:nifi-web-api to version 1.11.0 or higher.

[1.0.0,1.11.0)
  • C
Session Fixation

org.apache.nifi:nifi-web-api is a system to process and distribute data.

Affected versions of this package are vulnerable to Session Fixation. When using an authentication mechanism other than PKI, when the user clicks Log Out, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi.

How to fix Session Fixation?

Upgrade org.apache.nifi:nifi-web-api to version 1.10.0 or higher.

[1.0.0,1.10.0)
  • M
Cross-site Request Forgery (CSRF)

org.apache.nifi:nifi-web-api is a system to process and distribute data.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access, and injecting malicious code into an unprotected (plaintext HTTP) website which the targeted user later visits, but the possible damage warranted a Severe severity level.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade org.apache.nifi:nifi-web-api to version 1.8.0 or higher.

[1.0.0,1.8.0)
  • M
Deserialization of Untrusted Data

Apache NiFi is a system to process and distribute data.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data.

Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

How to fix Deserialization of Untrusted Data?

Upgrade Apache NiFi to 1.4.0 version or higher.

[,1.4.0)