CVE-2020-9491

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like…

published October 1, 2020

CVSS
—
EPSS
3%
Percentile
86.7
In the wild
Unconfirmed
What it is

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02871 · 86.7th percentile
Published
2020-10-01T19:57Z
EPSS history
Timeline
  • 01 OCT 19:57Z
    In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like…
    cvelistv5