[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMZNSyU5Px73u90adc1IbzX34PAkT5ZvkOjEH863xK48":3,"g5a-ex:apache\u002Fnifi@*":339,"g5a-family:apache\u002Fnifi":341},{"success":4,"data":5},true,{"product":6,"versions":175,"topVulnerabilitiesByEpss":253,"kevVulnerabilities":316,"seoMetadata":317,"meta":336},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":174},"apache","nifi",77,42,0,"2024-12-28",[14,17,19,21,23,25,27,29,31,33,35,37,39,42,44,46,48,50,53,55,58,61,64,66,68,70,72,74,76,78,80,82,84,86,88,90,92,94,96,98,100,102,104,106,108,110,112,114,116,118,120,122,124,126,128,130,132,134,136,138,140,142,144,146,148,150,152,154,156,158,160,162,164,166,168,170,172],{"version":15,"cve_count":11,"kev_count":11,"has_kev":16},"0.0.1",false,{"version":18,"cve_count":11,"kev_count":11,"has_kev":16},"0.0.2",{"version":20,"cve_count":11,"kev_count":11,"has_kev":16},"0.1.0",{"version":22,"cve_count":11,"kev_count":11,"has_kev":16},"0.2.0",{"version":24,"cve_count":11,"kev_count":11,"has_kev":16},"0.2.1",{"version":26,"cve_count":11,"kev_count":11,"has_kev":16},"0.3.0",{"version":28,"cve_count":11,"kev_count":11,"has_kev":16},"0.4.0",{"version":30,"cve_count":11,"kev_count":11,"has_kev":16},"0.4.1",{"version":32,"cve_count":11,"kev_count":11,"has_kev":16},"0.5.0",{"version":34,"cve_count":11,"kev_count":11,"has_kev":16},"0.5.1",{"version":36,"cve_count":11,"kev_count":11,"has_kev":16},"0.6.0",{"version":38,"cve_count":11,"kev_count":11,"has_kev":16},"0.6.1",{"version":40,"cve_count":41,"kev_count":11,"has_kev":16},"0.7.0",2,{"version":43,"cve_count":41,"kev_count":11,"has_kev":16},"0.7.1",{"version":45,"cve_count":11,"kev_count":11,"has_kev":16},"0.7.2",{"version":47,"cve_count":11,"kev_count":11,"has_kev":16},"0.7.3",{"version":49,"cve_count":11,"kev_count":11,"has_kev":16},"0.7.4",{"version":51,"cve_count":52,"kev_count":11,"has_kev":16},"1.0.0",3,{"version":54,"cve_count":52,"kev_count":11,"has_kev":16},"1.0.1",{"version":56,"cve_count":57,"kev_count":11,"has_kev":16},"1.1.0",6,{"version":59,"cve_count":60,"kev_count":11,"has_kev":16},"1.10.0",1,{"version":62,"cve_count":63,"kev_count":11,"has_kev":16},"1.1.1",5,{"version":65,"cve_count":11,"kev_count":11,"has_kev":16},"1.11.0",{"version":67,"cve_count":11,"kev_count":11,"has_kev":16},"1.11.1",{"version":69,"cve_count":11,"kev_count":11,"has_kev":16},"1.11.2",{"version":71,"cve_count":11,"kev_count":11,"has_kev":16},"1.11.3",{"version":73,"cve_count":11,"kev_count":11,"has_kev":16},"1.11.4",{"version":75,"cve_count":52,"kev_count":11,"has_kev":16},"1.1.2",{"version":77,"cve_count":11,"kev_count":11,"has_kev":16},"1.12.0",{"version":79,"cve_count":11,"kev_count":11,"has_kev":16},"1.12.1",{"version":81,"cve_count":60,"kev_count":11,"has_kev":16},"1.13.0",{"version":83,"cve_count":11,"kev_count":11,"has_kev":16},"1.13.1",{"version":85,"cve_count":11,"kev_count":11,"has_kev":16},"1.13.2",{"version":87,"cve_count":60,"kev_count":11,"has_kev":16},"1.14.0",{"version":89,"cve_count":60,"kev_count":11,"has_kev":16},"1.15.0",{"version":91,"cve_count":11,"kev_count":11,"has_kev":16},"1.15.3",{"version":93,"cve_count":11,"kev_count":11,"has_kev":16},"1.16.0",{"version":95,"cve_count":11,"kev_count":11,"has_kev":16},"1.16.1",{"version":97,"cve_count":11,"kev_count":11,"has_kev":16},"1.16.2",{"version":99,"cve_count":11,"kev_count":11,"has_kev":16},"1.16.3",{"version":101,"cve_count":11,"kev_count":11,"has_kev":16},"1.17.0",{"version":103,"cve_count":11,"kev_count":11,"has_kev":16},"1.18.0",{"version":105,"cve_count":11,"kev_count":11,"has_kev":16},"1.19.0",{"version":107,"cve_count":11,"kev_count":11,"has_kev":16},"1.19.1",{"version":109,"cve_count":52,"kev_count":11,"has_kev":16},"1.2.0",{"version":111,"cve_count":11,"kev_count":11,"has_kev":16},"1.20.0",{"version":113,"cve_count":11,"kev_count":11,"has_kev":16},"1.21.0",{"version":115,"cve_count":11,"kev_count":11,"has_kev":16},"1.22.0",{"version":117,"cve_count":11,"kev_count":11,"has_kev":16},"1.23.0",{"version":119,"cve_count":11,"kev_count":11,"has_kev":16},"1.23.1",{"version":121,"cve_count":11,"kev_count":11,"has_kev":16},"1.23.2",{"version":123,"cve_count":11,"kev_count":11,"has_kev":16},"1.24.0",{"version":125,"cve_count":11,"kev_count":11,"has_kev":16},"1.25.0",{"version":127,"cve_count":11,"kev_count":11,"has_kev":16},"1.26.0",{"version":129,"cve_count":11,"kev_count":11,"has_kev":16},"1.27.0",{"version":131,"cve_count":11,"kev_count":11,"has_kev":16},"1.28.0",{"version":133,"cve_count":11,"kev_count":11,"has_kev":16},"1.28.1",{"version":135,"cve_count":60,"kev_count":11,"has_kev":16},"1.3.0",{"version":137,"cve_count":11,"kev_count":11,"has_kev":16},"1.4.0",{"version":139,"cve_count":11,"kev_count":11,"has_kev":16},"1.5.0",{"version":141,"cve_count":11,"kev_count":11,"has_kev":16},"1.6.0",{"version":143,"cve_count":11,"kev_count":11,"has_kev":16},"1.7.0",{"version":145,"cve_count":11,"kev_count":11,"has_kev":16},"1.7.1",{"version":147,"cve_count":11,"kev_count":11,"has_kev":16},"1.8.0",{"version":149,"cve_count":11,"kev_count":11,"has_kev":16},"1.9.0",{"version":151,"cve_count":11,"kev_count":11,"has_kev":16},"1.9.1",{"version":153,"cve_count":11,"kev_count":11,"has_kev":16},"1.9.2",{"version":155,"cve_count":52,"kev_count":11,"has_kev":16},"2.0.0",{"version":157,"cve_count":11,"kev_count":11,"has_kev":16},"2.1.0",{"version":159,"cve_count":11,"kev_count":11,"has_kev":16},"2.2.0",{"version":161,"cve_count":11,"kev_count":11,"has_kev":16},"2.3.0",{"version":163,"cve_count":11,"kev_count":11,"has_kev":16},"2.4.0",{"version":165,"cve_count":11,"kev_count":11,"has_kev":16},"2.5.0",{"version":167,"cve_count":11,"kev_count":11,"has_kev":16},"2.6.0",{"version":169,"cve_count":11,"kev_count":11,"has_kev":16},"2.7.0",{"version":171,"cve_count":11,"kev_count":11,"has_kev":16},"2.7.1",{"version":173,"cve_count":11,"kev_count":11,"has_kev":16},"2.7.2","Nifi by Apache is a technology product with 77 tracked versions and 42 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252],{"version":15,"cve_count":11,"kev_count":11,"has_kev":16},{"version":18,"cve_count":11,"kev_count":11,"has_kev":16},{"version":20,"cve_count":11,"kev_count":11,"has_kev":16},{"version":22,"cve_count":11,"kev_count":11,"has_kev":16},{"version":24,"cve_count":11,"kev_count":11,"has_kev":16},{"version":26,"cve_count":11,"kev_count":11,"has_kev":16},{"version":28,"cve_count":11,"kev_count":11,"has_kev":16},{"version":30,"cve_count":11,"kev_count":11,"has_kev":16},{"version":32,"cve_count":11,"kev_count":11,"has_kev":16},{"version":34,"cve_count":11,"kev_count":11,"has_kev":16},{"version":36,"cve_count":11,"kev_count":11,"has_kev":16},{"version":38,"cve_count":11,"kev_count":11,"has_kev":16},{"version":40,"cve_count":41,"kev_count":11,"has_kev":16},{"version":43,"cve_count":41,"kev_count":11,"has_kev":16},{"version":45,"cve_count":11,"kev_count":11,"has_kev":16},{"version":47,"cve_count":11,"kev_count":11,"has_kev":16},{"version":49,"cve_count":11,"kev_count":11,"has_kev":16},{"version":51,"cve_count":52,"kev_count":11,"has_kev":16},{"version":54,"cve_count":52,"kev_count":11,"has_kev":16},{"version":56,"cve_count":57,"kev_count":11,"has_kev":16},{"version":59,"cve_count":60,"kev_count":11,"has_kev":16},{"version":62,"cve_count":63,"kev_count":11,"has_kev":16},{"version":65,"cve_count":11,"kev_count":11,"has_kev":16},{"version":67,"cve_count":11,"kev_count":11,"has_kev":16},{"version":69,"cve_count":11,"kev_count":11,"has_kev":16},{"version":71,"cve_count":11,"kev_count":11,"has_kev":16},{"version":73,"cve_count":11,"kev_count":11,"has_kev":16},{"version":75,"cve_count":52,"kev_count":11,"has_kev":16},{"version":77,"cve_count":11,"kev_count":11,"has_kev":16},{"version":79,"cve_count":11,"kev_count":11,"has_kev":16},{"version":81,"cve_count":60,"kev_count":11,"has_kev":16},{"version":83,"cve_count":11,"kev_count":11,"has_kev":16},{"version":85,"cve_count":11,"kev_count":11,"has_kev":16},{"version":87,"cve_count":60,"kev_count":11,"has_kev":16},{"version":89,"cve_count":60,"kev_count":11,"has_kev":16},{"version":91,"cve_count":11,"kev_count":11,"has_kev":16},{"version":93,"cve_count":11,"kev_count":11,"has_kev":16},{"version":95,"cve_count":11,"kev_count":11,"has_kev":16},{"version":97,"cve_count":11,"kev_count":11,"has_kev":16},{"version":99,"cve_count":11,"kev_count":11,"has_kev":16},{"version":101,"cve_count":11,"kev_count":11,"has_kev":16},{"version":103,"cve_count":11,"kev_count":11,"has_kev":16},{"version":105,"cve_count":11,"kev_count":11,"has_kev":16},{"version":107,"cve_count":11,"kev_count":11,"has_kev":16},{"version":109,"cve_count":52,"kev_count":11,"has_kev":16},{"version":111,"cve_count":11,"kev_count":11,"has_kev":16},{"version":113,"cve_count":11,"kev_count":11,"has_kev":16},{"version":115,"cve_count":11,"kev_count":11,"has_kev":16},{"version":117,"cve_count":11,"kev_count":11,"has_kev":16},{"version":119,"cve_count":11,"kev_count":11,"has_kev":16},{"version":121,"cve_count":11,"kev_count":11,"has_kev":16},{"version":123,"cve_count":11,"kev_count":11,"has_kev":16},{"version":125,"cve_count":11,"kev_count":11,"has_kev":16},{"version":127,"cve_count":11,"kev_count":11,"has_kev":16},{"version":129,"cve_count":11,"kev_count":11,"has_kev":16},{"version":131,"cve_count":11,"kev_count":11,"has_kev":16},{"version":133,"cve_count":11,"kev_count":11,"has_kev":16},{"version":135,"cve_count":60,"kev_count":11,"has_kev":16},{"version":137,"cve_count":11,"kev_count":11,"has_kev":16},{"version":139,"cve_count":11,"kev_count":11,"has_kev":16},{"version":141,"cve_count":11,"kev_count":11,"has_kev":16},{"version":143,"cve_count":11,"kev_count":11,"has_kev":16},{"version":145,"cve_count":11,"kev_count":11,"has_kev":16},{"version":147,"cve_count":11,"kev_count":11,"has_kev":16},{"version":149,"cve_count":11,"kev_count":11,"has_kev":16},{"version":151,"cve_count":11,"kev_count":11,"has_kev":16},{"version":153,"cve_count":11,"kev_count":11,"has_kev":16},{"version":155,"cve_count":52,"kev_count":11,"has_kev":16},{"version":157,"cve_count":11,"kev_count":11,"has_kev":16},{"version":159,"cve_count":11,"kev_count":11,"has_kev":16},{"version":161,"cve_count":11,"kev_count":11,"has_kev":16},{"version":163,"cve_count":11,"kev_count":11,"has_kev":16},{"version":165,"cve_count":11,"kev_count":11,"has_kev":16},{"version":167,"cve_count":11,"kev_count":11,"has_kev":16},{"version":169,"cve_count":11,"kev_count":11,"has_kev":16},{"version":171,"cve_count":11,"kev_count":11,"has_kev":16},{"version":173,"cve_count":11,"kev_count":11,"has_kev":16},[254,262,269,275,281,287,295,300,306,311],{"cveId":255,"description":256,"publishedDate":257,"cvssScore":258,"cvssVersion":259,"severity":260,"isKev":16,"epssScore":261},"CVE-2020-27223","In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.","2021-02-26",5.2,"v3.1","Medium",0.78031,{"cveId":263,"description":264,"publishedDate":265,"cvssScore":266,"cvssVersion":259,"severity":267,"isKev":16,"epssScore":268},"CVE-2023-34468","The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.\n\nThe resolution validates the Database URL and rejects H2 JDBC locations.\n\nYou are recommended to upgrade to version 1.22.0 or later which fixes this issue.","2023-06-12",8.8,"High",0.61869,{"cveId":270,"description":271,"publishedDate":272,"cvssScore":273,"cvssVersion":259,"severity":267,"isKev":16,"epssScore":274},"CVE-2019-10086","In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.","2019-08-20",7.3,0.28384,{"cveId":276,"description":277,"publishedDate":278,"cvssScore":279,"cvssVersion":259,"severity":260,"isKev":16,"epssScore":280},"CVE-2024-37389","Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation.","2024-07-08",4.6,0.24031,{"cveId":282,"description":283,"publishedDate":284,"cvssScore":285,"cvssVersion":259,"severity":267,"isKev":16,"epssScore":286},"CVE-2021-20190","A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","2021-01-19",8.1,0.07573,{"cveId":288,"description":289,"publishedDate":290,"cvssScore":291,"cvssVersion":292,"severity":293,"isKev":16,"epssScore":294},"CVE-2017-15697","A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.","2018-01-23",9.8,"v3.0","Critical",0.04832,{"cveId":296,"description":297,"publishedDate":298,"cvssScore":291,"cvssVersion":292,"severity":293,"isKev":16,"epssScore":299},"CVE-2018-1309","Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.","2018-05-23",0.0452,{"cveId":301,"description":302,"publishedDate":303,"cvssScore":304,"cvssVersion":259,"severity":260,"isKev":16,"epssScore":305},"CVE-2020-1928","An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.","2020-01-28",5.3,0.03959,{"cveId":307,"description":308,"publishedDate":309,"cvssScore":266,"cvssVersion":259,"severity":267,"isKev":16,"epssScore":310},"CVE-2022-33140","The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the default configuration. Command injection requires ShellUserGroupProvider to be one of the enabled User Group Providers in the Authorizers configuration. Command injection also requires an authenticated user with elevated privileges. Apache NiFi requires an authenticated user with authorization to modify access policies in order to execute the command. Apache NiFi Registry requires an authenticated user with authorization to read user groups in order to execute the command. The resolution removes command formatting based on user-provided arguments.","2022-06-15",0.03818,{"cveId":312,"description":313,"publishedDate":314,"cvssScore":291,"cvssVersion":292,"severity":293,"isKev":16,"epssScore":315},"CVE-2017-5636","In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization\u002Fdeserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node.","2017-10-19",0.03599,[],{"title":318,"metaDescription":319,"keywords":320,"structuredData":321},"Nifi by Apache - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Nifi by Apache covering 77 versions with 42 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Nifi vulnerabilities, Nifi security, Nifi CVE, Apache Nifi, Nifi threat intelligence, Apache security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":322,"@type":323,"name":324,"description":319,"url":325,"manufacturer":326,"applicationCategory":330,"softwareVersion":331,"mainEntity":332},"https:\u002F\u002Fschema.org","SoftwareApplication","Nifi","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fapache\u002Fnifi",{"@type":327,"name":328,"url":329},"Organization","Apache","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fapache","Security Software","77 versions tracked",{"@type":333,"name":334,"description":335,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Nifi Security Vulnerabilities","Security vulnerabilities affecting Nifi by Apache",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":337,"apiVersion":338},"2026-10-17T20:36:51.441Z","3.0",{"rows":340,"total":11,"capped":16,"failed":11},[],[342,344],{"product":343,"cves":41},"nifi_minifi_c\\+\\+",{"product":345,"cves":41},"nifi_registry"]