GHSA-fmqw-vqh5-cwq9

Source

https://github.com/advisories/GHSA-fmqw-vqh5-cwq9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/12/GHSA-fmqw-vqh5-cwq9/GHSA-fmqw-vqh5-cwq9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fmqw-vqh5-cwq9

Aliases

CVE-2019-12421

Published

2019-12-02T18:19:39Z

Modified

2024-02-16T08:16:10.414966Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache NiFi user log out issue

Details

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-613"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2019-12-02T17:32:47Z"
}

References

Affected packages

Maven / org.apache.nifi:nifi-web-security

Package

Name: org.apache.nifi:nifi-web-security; View open source insights on deps.dev
Purl: pkg:maven/org.apache.nifi/nifi-web-security

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.3.0

Fixed

1.10.0

Affected versions

1.*

1.3.0

1.4.0

1.5.0

1.6.0

1.7.0

1.7.1

1.8.0

1.9.0

1.9.1

1.9.2

Maven / org.apache.nifi:nifi-web-api