GHSA-7mqj-xgf8-p59v

Suggest an improvement
Source
https://github.com/advisories/GHSA-7mqj-xgf8-p59v
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-7mqj-xgf8-p59v/GHSA-7mqj-xgf8-p59v.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-7mqj-xgf8-p59v
Aliases
Published
2024-10-29T09:30:51Z
Modified
2026-09-04T11:55:23Z
Severity
  • 4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Apache NiFi Cross-site Scripting vulnerability
Details

Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.28.0 or 2.0.0-M4 is the recommended mitigation.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-10-29T21:33:09Z",
    "nvd_published_at":  "2024-10-29T09:15:07Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / org.apache.nifi:nifi-web-ui

Package

Name
org.apache.nifi:nifi-web-ui
View open source insights on deps.dev
Purl
pkg:maven/org.apache.nifi/nifi-web-ui

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.10.0
Fixed
1.28.0

Affected versions

1.*
1.10.0
1.11.0
1.11.1
1.11.2
1.11.3
1.11.4
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.14.0
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
1.16.1
1.16.2
1.16.3
1.17.0
1.18.0
1.19.0
1.19.1
1.20.0
1.21.0
1.22.0
1.23.0
1.23.1
1.23.2
1.24.0
1.25.0
1.26.0
1.27.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-7mqj-xgf8-p59v/GHSA-7mqj-xgf8-p59v.json"

Maven / org.apache.nifi:nifi-web-ui

Package

Name
org.apache.nifi:nifi-web-ui
View open source insights on deps.dev
Purl
pkg:maven/org.apache.nifi/nifi-web-ui

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0-M1
Fixed
2.0.0-M4

Affected versions

2.*
2.0.0-M1
2.0.0-M2
2.0.0-M3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-7mqj-xgf8-p59v/GHSA-7mqj-xgf8-p59v.json"