CVE-2019-10083: Apache NiFi process group information disclosure
Summary
CVE-2019-10083: Apache NiFi process group information disclosure. Affects org.apache.nifi:nifi-web-api versions >= 1.3.0, < 1.10.0. Fixed in 1.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache NiFi is an open-source data integration platform that enables the automation of data flow between different systems. It provides a web-based interface for designing, controlling, and monitoring data flows. The 'org.apache.nifi:nifi-web-api' and 'org.apache.nifi:nifi' packages are part of Apache NiFi and are used for managing and interacting with the NiFi instance.
Vulnerability Detail
The vulnerability (CVE-2019-10083) exists in NiFi versions 1.3.0 to 1.9.2. When updating a Process Group via the API, the response includes all of its contents, such as processors and controller services, at the topmost level. This means that even if a user does not have read access to certain processors or controller services, the response will still include their details. This information disclosure can potentially expose sensitive data to unauthorized users.
How To Fix
Minimum fixed version
1.10.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of NiFi.
Conclusion
In conclusion, the Apache NiFi process group information disclosure vulnerability (CVE-2019-10083) allows unauthorized users to access sensitive data through the API response. To mitigate this vulnerability, it is crucial to upgrade to NiFi version 1.10.0 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi-web-api →
FAQ
Apache NiFi is an open-source data integration platform that allows the automation of data flow between different systems. It provides a web-based interface for designing, controlling, and monitoring data flows.
NiFi versions 1.3.0 to 1.9.2 are affected by this vulnerability.
This vulnerability can lead to the exposure of sensitive data to unauthorized users. The API response includes details about processors and controller services that the user may not have read access to.
To fix this vulnerability, it is recommended to upgrade to NiFi version 1.10.0 or later.
No specific workaround is mentioned for this vulnerability. Upgrading to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.nifi:nifi-web-api.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
