org.apache.nifi:nifi-web-api@1.4.0 vulnerabilities
-
latest version
1.25.0
-
latest non vulnerable version
-
first published
9 years ago
-
latest version published
3 months ago
-
licenses detected
- [0.0.1-incubating,)
-
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.apache.nifi:nifi-web-api package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.Vulnerability | Vulnerable Version |
---|---|
org.apache.nifi:nifi-web-api is a system to process and distribute data. Affected versions of this package are vulnerable to Information Exposure. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present. How to fix Information Exposure? Upgrade |
[1.0.0,1.11.0)
|
org.apache.nifi:nifi-web-api is a system to process and distribute data. Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. This vulnerability is not exploitable via other browsers. How to fix Cross-site Scripting (XSS)? Upgrade |
[1.0.0,1.11.0)
|
org.apache.nifi:nifi-web-api is a system to process and distribute data. Affected versions of this package are vulnerable to Information Exposure. When updating a Process Group via the API, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to. How to fix Information Exposure? Upgrade |
[1.3.0,1.10.0)
|
org.apache.nifi:nifi-web-api is a system to process and distribute data. Affected versions of this package are vulnerable to Session Fixation. When using an authentication mechanism other than PKI, when the user clicks Log Out, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi. How to fix Session Fixation? Upgrade |
[1.0.0,1.10.0)
|
org.apache.nifi:nifi-web-api is a system to process and distribute data. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access, and injecting malicious code into an unprotected (plaintext HTTP) website which the targeted user later visits, but the possible damage warranted a Severe severity level. How to fix Cross-site Request Forgery (CSRF)? Upgrade org.apache.nifi:nifi-web-api to version 1.8.0 or higher. |
[1.0.0,1.8.0)
|