Vulnerability · Published Jan 28, 2020 · Assigned by apache
CVE-2020-1928
Medium 5.3
In plain English
A medium-severity security flaw in Apache NiFi from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.0% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)4.0%top 9.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.nifi:nifi-parameter | 1.11.0 | GHSA-w4fj-ccr6-7pcp |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache NiFi | Apache NiFi 1.10.0 |
References
- https://nifi.apache.org/security.html#CVE-2020-1928 x_refsource_CONFIRM
- [tomcat-users] 20200302 Re: AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution mailing-list, x_refsource_MLIST
- [tomcat-users] 20200302 AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution mailing-list, x_refsource_MLIST
- [tomcat-users] 20200302 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution mailing-list, x_refsource_MLIST