CVE-2023-49145

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-49145
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49145.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-49145
Aliases
Published
2023-11-27T22:14:02.850Z
Modified
2026-07-15T01:49:07.672757815Z
Severity
  • 7.9 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L CVSS Calculator
Summary
Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt
Details

Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0-M1 is the recommended mitigation.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49145.json",
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "0.7.0"
                },
                {
                    "last_affected": "1.23.2"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "0.7.0"
                },
                {
                    "fixed": "1.23.2"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/nifi

Affected ranges

Type
GIT
Repo
https://github.com/apache/nifi
Events
Introduced
f5629062c5e2a6c55fb62255aee74c4f25d93e7b
Fixed
5241f434829ca46a26a475600ef7c00e1e271e37
Database specific 
{
    "cpe": "cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0.7.0"
        },
        {
            "fixed": "1.24.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49145.json"