CVE-2020-9487

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a…

published October 1, 2020

CVSS
—
EPSS
3%
Percentile
87.5
In the wild
Unconfirmed
What it is

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03050 · 87.5th percentile
Published
2020-10-01T19:53Z
EPSS history
Timeline
  • 01 OCT 19:53Z
    In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a…
    cvelistv5