CVE-2024-37389CWE-79

Apache NiFi: Improper Neutralization of Input in Parameter Context Description

Medium · published July 8, 2024

CVSS v3.1

4.6

EPSS

24%

Percentile

97.8

In the wild

Unconfirmed

What it is

Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation.

The record

Technical detail

CVSS v3.1: 4.6 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.24031 · 97.8th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2024-07-08T07:29Z

EPSS history

Timeline

08 JUL 07:29Z
Apache NiFi: Improper Neutralization of Input in Parameter Context Description
cvelistv5