Apache NiFi vulnerable to Cross-site Scripting
Moderate severity
GitHub Reviewed
Published
Jul 8, 2024
to the GitHub Advisory Database
•
Updated Jul 11, 2024
Package
Affected versions
>= 1.10.0, < 1.27.0
>= 2.0.0-M1, < 2.0.0-M4
Patched versions
1.27.0
2.0.0-M4
Description
Published by the National Vulnerability Database
Jul 8, 2024
Published to the GitHub Advisory Database
Jul 8, 2024
Reviewed
Jul 8, 2024
Last updated
Jul 11, 2024
Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation.
References