CVE-2020-1928: Apache NiFi 1.10.0 Information Disclosure Vulnerability
Summary
CVE-2020-1928: An information disclosure vulnerability was found in Apache NiFi 1.10.0. Affects nifi versions >= 1.10.0, <= 1.10.0. No fix is published. How to fix ↓
Also tracked for
- org.apache.nifi:nifi-parameter · Maven
The same CVE-2020-1928 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi is a robust data integration tool designed to automate the flow of data between systems. It provides an intuitive user interface for managing data flows, enabling users to create, monitor, and control data pipelines. However, version 1.10.0 has a vulnerability that could expose sensitive information due to improper logging of sensitive parameters.
Vulnerability Detail
An information disclosure vulnerability exists in Apache NiFi version 1.10.0, where the sensitive parameter parser logs parsed values for debugging purposes. This logging behavior can inadvertently expose sensitive information, such as literal values entered in sensitive properties, when no parameter is present. This could lead to unauthorized access to sensitive data, potentially compromising user privacy and security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable the logging of sensitive parameters by modifying the logging configuration in your NiFi settings. Ensure that sensitive properties are not logged by adjusting the log level or filtering out sensitive information.
Conclusion
The information disclosure vulnerability in Apache NiFi 1.10.0 poses a significant risk by exposing sensitive data through improper logging. It is crucial to update to a patched version to mitigate this risk and ensure the security of your data flows.
See every vulnerability recorded for nifi →
FAQ
CVE-2020-1928 is a vulnerability in Apache NiFi 1.10.0 that allows for information disclosure due to improper logging of sensitive parameters.
This vulnerability can expose sensitive data entered in properties, potentially leading to unauthorized access and privacy breaches.
Yes, updating to a version later than 1.10.0 will resolve this vulnerability.
Consider applying the workaround by adjusting your logging configuration to prevent sensitive data from being logged.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for nifi.
