Vulnerability Description
Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.28.0 or 2.0.0-M4 is the recommended mitigation.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Nifi | >= 1.10.0, <= 1.27.0 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/shdv0tw9hggj7tx9pl7g93mgok2lwbj9Mailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2024/10/28/1
FAQ
What is CVE-2024-45477?
CVE-2024-45477 is a vulnerability with a CVSS score of 4.6 (MEDIUM). Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authentic...
How severe is CVE-2024-45477?
CVE-2024-45477 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-45477?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Nifi.