org.apache.nifi:nifi-web-security@1.1.0 vulnerabilities
-
latest version
1.25.0
-
latest non vulnerable version
-
first published
9 years ago
-
latest version published
3 months ago
-
licenses detected
- [0.0.1-incubating,)
-
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.apache.nifi:nifi-web-security package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.| Vulnerability | Vulnerable Version |
|---|---|
org.apache.nifi:nifi-web-security is a system to process and distribute data. Affected versions of this package are vulnerable to Denial of Service (DoS). The NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens. How to fix Denial of Service (DoS)? Upgrade |
[1.0.0,1.12.0)
|
org.apache.nifi:nifi-web-security is a system to process and distribute data. Affected versions of this package are vulnerable to Information Exposure. The flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was printed, potentially containing sensitive values in plaintext. How to fix Information Exposure? Upgrade |
[,1.11.1)
|
org.apache.nifi:nifi-web-security is a system to process and distribute data. Affected versions of this package are vulnerable to Session Fixation. When using an authentication mechanism other than PKI, when the user clicks Log Out, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi. How to fix Session Fixation? Upgrade |
[1.0.0,1.10.0)
|
Apache NiFi is a system to process and distribute data. Affected versions of this package are vulnerable to Deserialization of Untrusted Data. Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release. How to fix Deserialization of Untrusted Data? Upgrade |
[,1.4.0)
|
Affected versions of this package are vulnerable to User Impersonation. An attacker could carefully craft a username to impersonate another user and gain their permissions on a replicated request to another node, via the the proxy chain serialization/deserialization functions as they are vulnerable to an injection attack. This only occurs in a cluster environment. |
[0.7.0,0.7.2)
[1.1.0,1.1.2)
|
|
[0.7.0,0.7.2)
[1.1.0,1.1.2)
|