CVE-2024-45477

Published: Oct 29, 2024Modified: Jun 17, 2026

4.6

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Exploitability: 2.1 / Impact: 2.5

Source: NVD

Description

Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.28.0 or 2.0.0-M4 is the recommended mitigation.

Affected (4)

Products: Apache: Nifi

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Apache Nifi	From 1.10.0 to 1.27.0
Apache Nifi	Version 2.0.0 milestone1
Apache Nifi	Version 2.0.0 milestone2
Apache Nifi	Version 2.0.0 milestone3

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://lists.apache.org/thread/shdv0tw9hggj7tx9pl7g93mgok2lwbj9

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2024/10/28/1

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.