# org.apache.nifi:nifi (Maven) vulnerabilities 21 known vulnerabilities, with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://central.sonatype.com/artifact/org.apache.nifi/nifi ## Advisories (21) ### [CVE-2022-33140](https://cve.now/CVE-2022-33140): Improper Neutralization of Command Elements in Shell User Group Provider - Severity: Unrated - Published: Jun 15, 2022 - Affected: from 1.10.0, fixed in 1.16.3. ### [CVE-2022-29265](https://cve.now/CVE-2022-29265): Improper Restriction of XML External Entity References in Multiple Components - Severity: Unrated - Published: Apr 30, 2022 - Affected: from 0.0.1, fixed in 1.16.1. ### [CVE-2021-44145](https://cve.now/CVE-2021-44145): Apache NiFi information disclosure by XXE - Severity: Unrated - Published: Dec 17, 2021 - Affected: fixed in 1.15.1. ### [CVE-2020-9491](https://cve.now/CVE-2020-9491): In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by… - Severity: Unrated - Published: Oct 1, 2020 - Affected: from 1.2.0, fixed in 1.12.0-RC1. ### [CVE-2020-13940](https://cve.now/CVE-2020-13940): In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed… - Severity: Unrated - Published: Oct 1, 2020 - Affected: from 1.0.0, fixed in 1.12.0-RC1. ### [CVE-2020-9487](https://cve.now/CVE-2020-9487): In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a… - Severity: Unrated - Published: Oct 1, 2020 - Affected: from 1.0.0, fixed in 1.12.0-RC1. ### [CVE-2020-1933](https://cve.now/CVE-2020-1933): A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. - Severity: Unrated - Published: Jan 28, 2020 - Affected: from 1.0.0, fixed in 1.11.0. ### [CVE-2019-10083](https://cve.now/CVE-2019-10083): When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at… - Severity: Unrated - Published: Nov 19, 2019 - Affected: from 1.3.0, fixed in 1.10.0. ### [CVE-2019-10080](https://cve.now/CVE-2019-10080): The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. - Severity: Unrated - Published: Nov 19, 2019 - Affected: from 1.3.0, fixed in 1.10.0. ### [CVE-2018-17195](https://cve.now/CVE-2018-17195): The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle… - Severity: Unrated - Published: Dec 19, 2018 - Affected: from 1.0.0, fixed in 1.8.0. ### [CVE-2018-17193](https://cve.now/CVE-2018-17193): The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a… - Severity: Unrated - Published: Dec 19, 2018 - Affected: from 1.0.0, fixed in 1.8.0. ### [CVE-2018-17192](https://cve.now/CVE-2018-17192): The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. - Severity: Unrated - Published: Dec 19, 2018 - Affected: from 1.0.0, fixed in 1.8.0. ### [CVE-2018-1310](https://cve.now/CVE-2018-1310): Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. - Severity: Unrated - Published: May 23, 2018 - Affected: fixed in 1.6.0. ### [CVE-2017-15697](https://cve.now/CVE-2017-15697): A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code… - Severity: Unrated - Published: Jan 23, 2018 - Affected: from 1.0.0, fixed in 1.5.0. ### [CVE-2017-12632](https://cve.now/CVE-2017-12632): A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. - Severity: Unrated - Published: Jan 23, 2018 - Affected: from 1.0.0, fixed in 1.5.0. ### [CVE-2017-5636](https://cve.now/CVE-2017-5636): In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to… - Severity: Unrated - Published: Oct 19, 2017 - Affected: fixed in 0.7.2; from 1.0.0, fixed in 1.1.2. ### [CVE-2017-5635](https://cve.now/CVE-2017-5635): In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the… - Severity: Unrated - Published: Oct 19, 2017 - Affected: fixed in 0.7.2; from 1.0.0, fixed in 1.1.2. ### [CVE-2016-8748](https://cve.now/CVE-2016-8748): In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when… - Severity: Unrated - Published: Oct 19, 2017 - Affected: fixed in 1.0.1; from 1.1.0, fixed in 1.1.1. ### [CVE-2017-12623](https://cve.now/CVE-2017-12623): An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE)… - Severity: Unrated - Published: Oct 10, 2017 - Affected: from 1.0.0, fixed in 1.4.0. ### [CVE-2017-7667](https://cve.now/CVE-2017-7667): Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same… - Severity: Unrated - Published: Jun 12, 2017 - Affected: fixed in 0.7.4; from 1.0.0, fixed in 1.3.0. ### [CVE-2017-7665](https://cve.now/CVE-2017-7665): In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms… - Severity: Unrated - Published: Jun 12, 2017 - Affected: fixed in 0.7.4; from 1.0.0, fixed in 1.3.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.nifi:nifi Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.