CVE-2020-9486: Insertion of Sensitive Information into Log File in Apache NiFi
Summary
CVE-2020-9486: Insertion of Sensitive Information into Log File in Apache NiFi Stateless. Affects org.apache.nifi:nifi-stateless versions >= 1.10.0, < 1.12.0-RC1. Fixed in 1.12.0-RC1. How to fix ↓
Also tracked for
- nifi · Bitnami
The same CVE-2020-9486 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache NiFi is an open-source data integration tool that provides a web-based interface to design, control, and manage the flow of data between systems. It allows users to create data pipelines, transform data, and process it in real-time. NiFi is widely used in various industries for data ingestion, processing, and distribution tasks. However, versions 1.10.0 to 1.11.4 of Apache NiFi are vulnerable to an issue that results in the insertion of sensitive information into log files.
Vulnerability Detail
The vulnerability in Apache NiFi allows sensitive property values to be included in log output. When a flow is triggered, the flow definition configuration JSON is printed, potentially exposing sensitive values in plaintext. This can lead to unauthorized access to sensitive information, such as passwords, API keys, or database credentials. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.12.0-RC1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version to mitigate the risk of exposing sensitive information.
Conclusion
In conclusion, Apache NiFi versions 1.10.0 to 1.11.4 are vulnerable to the insertion of sensitive information into log files. This can result in unauthorized access to sensitive data. To mitigate this risk, it is crucial to upgrade to Apache NiFi version 1.12.0-RC1 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi-stateless →
FAQ
Apache NiFi is an open-source data integration tool used for designing and managing data flows between systems.
This vulnerability can lead to unauthorized access to sensitive information, potentially compromising the security of the system.
To fix this vulnerability, upgrade to Apache NiFi version 1.12.0-RC1 or later.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
