org.apache.nifi:nifi-web-api@1.7.1 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.apache.nifi:nifi-web-api package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Scripting (XSS)

org.apache.nifi:nifi-web-api is a system to process and distribute data.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. This vulnerability is not exploitable via other browsers.

How to fix Cross-site Scripting (XSS)?

Upgrade org.apache.nifi:nifi-web-api to version 1.11.0 or higher.

[1.0.0,1.11.0)
  • M
Information Exposure

org.apache.nifi:nifi-web-api is a system to process and distribute data.

Affected versions of this package are vulnerable to Information Exposure. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.

How to fix Information Exposure?

Upgrade org.apache.nifi:nifi-web-api to version 1.11.0 or higher.

[1.0.0,1.11.0)
  • M
Information Exposure

org.apache.nifi:nifi-web-api is a system to process and distribute data.

Affected versions of this package are vulnerable to Information Exposure. When updating a Process Group via the API, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.

How to fix Information Exposure?

Upgrade org.apache.nifi:nifi-web-api to version 1.10.0 or higher.

[1.3.0,1.10.0)
  • C
Session Fixation

org.apache.nifi:nifi-web-api is a system to process and distribute data.

Affected versions of this package are vulnerable to Session Fixation. When using an authentication mechanism other than PKI, when the user clicks Log Out, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi.

How to fix Session Fixation?

Upgrade org.apache.nifi:nifi-web-api to version 1.10.0 or higher.

[1.0.0,1.10.0)
  • M
Cross-site Request Forgery (CSRF)

org.apache.nifi:nifi-web-api is a system to process and distribute data.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access, and injecting malicious code into an unprotected (plaintext HTTP) website which the targeted user later visits, but the possible damage warranted a Severe severity level.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade org.apache.nifi:nifi-web-api to version 1.8.0 or higher.

[1.0.0,1.8.0)