CVE-2023-49145highCWE-79

CVE-2023-49145: falha de alta gravidade em Apache NiFi

Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache NiFi+ Monitorar org.apache.nifi:nifi-jolt-transform-json-ui

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.9epss 1.2%
Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0-M1 is the recommended mitigation.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
Produtos afetados
Apache Software Foundation · Apache NiFi
CVEs relacionadas — Apache NiFi

No mesmo produto, das mais perigosas para as menos.

CVE-2023-34468HIGHApache NiFi: Potential Code Injection with Database Services using H2EPSS 61.9%CVE-2024-37389MEDIUMApache NiFi: Improper Neutralization of Input in Parameter Context DescriptionEPSS 24.0%CVE-2017-15697—CVE-2017-15697EPSS 4.8%CVE-2018-1309—CVE-2018-1309EPSS 4.4%CVE-2020-1928—CVE-2020-1928EPSS 4.0%CVE-2017-5636—CVE-2017-5636EPSS 3.6%