CVE-2026-62354: falha de alta gravidade em Apache NiFi
Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 0.5%
Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying Parameter Context configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, requiring write access to submit Parameter Context validation requests.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:I/V:C/RE:L/U:Amber
Produtos afetados
Apache Software Foundation · Apache NiFiCVEs relacionadas — Apache NiFi
No mesmo produto, das mais perigosas para as menos.
CVE-2023-34468HIGHApache NiFi: Potential Code Injection with Database Services using H2EPSS 61.9%CVE-2024-37389MEDIUMApache NiFi: Improper Neutralization of Input in Parameter Context DescriptionEPSS 24.0%CVE-2017-15697—CVE-2017-15697EPSS 4.8%CVE-2018-1309—CVE-2018-1309EPSS 4.4%CVE-2020-1928—CVE-2020-1928EPSS 4.0%CVE-2017-5636—CVE-2017-5636EPSS 3.6%