CVE-2020-9487

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-9487
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-9487.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-9487
Aliases
Published
2020-10-01T20:15:14.253Z
Modified
2026-04-10T04:28:43.512632Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens.

References

Affected packages

Git / github.com/apache/nifi

Affected ranges

Type
GIT
Repo
https://github.com/apache/nifi
Events
Introduced
74d5224783dfdc513f6b3ad5ed96671d3c581707
Last affected
4d940bb151eb8d250b0319318b96d23c4a9819ae
Database specific 
{
    "versions": [
        {
            "introduced": "1.0.0"
        },
        {
            "last_affected": "1.11.4"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-9487.json"