Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.nifi:nifi

21 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
21
Registry
Maven Central

Advisories 21

  • Improper Neutralization of Command Elements in Shell User Group Provider

    Affected: from 1.10.0, fixed in 1.16.3.

  • Improper Restriction of XML External Entity References in Multiple Components

    Affected: from 0.0.1, fixed in 1.16.1.

  • Apache NiFi information disclosure by XXE

    Affected: fixed in 1.15.1.

  • In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by…

    Affected: from 1.2.0, fixed in 1.12.0-RC1.

  • In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed…

    Affected: from 1.0.0, fixed in 1.12.0-RC1.

  • In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a…

    Affected: from 1.0.0, fixed in 1.12.0-RC1.

  • A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0.

    Affected: from 1.0.0, fixed in 1.11.0.

  • When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at…

    Affected: from 1.3.0, fixed in 1.10.0.

  • The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file.

    Affected: from 1.3.0, fixed in 1.10.0.

  • The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle…

    Affected: from 1.0.0, fixed in 1.8.0.

  • The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a…

    Affected: from 1.0.0, fixed in 1.8.0.

  • The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers.

    Affected: from 1.0.0, fixed in 1.8.0.

  • Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability.

    Affected: fixed in 1.6.0.

  • A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code…

    Affected: from 1.0.0, fixed in 1.5.0.

  • A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server.

    Affected: from 1.0.0, fixed in 1.5.0.

Show all 21 advisoriesShow fewer advisories

  • In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to…

    Affected: fixed in 0.7.2; from 1.0.0, fixed in 1.1.2.

  • In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the…

    Affected: fixed in 0.7.2; from 1.0.0, fixed in 1.1.2.

  • In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when…

    Affected: fixed in 1.0.1; from 1.1.0, fixed in 1.1.1.

  • An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE)…

    Affected: from 1.0.0, fixed in 1.4.0.

  • Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same…

    Affected: fixed in 0.7.4; from 1.0.0, fixed in 1.3.0.

  • In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms…

    Affected: fixed in 0.7.4; from 1.0.0, fixed in 1.3.0.