Lucene search

GitHub Advisory DatabaseGHSA-PQHQ-XX62-2V2P

HistoryJan 06, 2022 - 8:35 p.m.

Cross-site scripting in Apache NiFi

2022-01-0620:35:39

CWE-79

GitHub Advisory Database

github.com

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.002 Low

EPSS

Percentile

52.8%

JSON

A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers.

Affected configurations

Vulners

Node

org.apache.nifi\Matchnifi

CPENameOperatorVersion
org.apache.nifi:nifile1.10.0

CPE	Name	Operator	Version
	org.apache.nifi:nifi	le	1.10.0

References

github.com/advisories/GHSA-pqhq-xx62-2v2p

github.com/apache/nifi/pull/3991

nifi.apache.org/security.html#CVE-2020-1933

nvd.nist.gov/vuln/detail/CVE-2020-1933

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.002 Low

EPSS

Percentile

52.8%

JSON

Related for GHSA-PQHQ-XX62-2V2P