1. Home
  2. CVE Database
  3. CVE-2020-9482
MEDIUM · 6.5

CVE-2020-9482

If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication token on the client side but not on the serv...

Vulnerability Description

If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi Registry.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
ApacheNifi Registry>= 0.1.0, <= 0.5.0

Related Weaknesses (CWE)

CWE-613

References

FAQ

What is CVE-2020-9482?

CVE-2020-9482 is a vulnerability with a CVSS score of 6.5 (MEDIUM). If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication token on the client side but not on the serv...

How severe is CVE-2020-9482?

CVE-2020-9482 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-9482?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Nifi Registry.