CVE-2019-10083: Infoleak
When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10083?
The severity of CVE-2019-10083 is medium with a score of 5.3.
How does CVE-2019-10083 affect NiFi versions?
CVE-2019-10083 affects NiFi versions 1.3.0 to 1.9.2.
What is the impact of CVE-2019-10083?
The impact of CVE-2019-10083 is that the response to the request includes details about processors and controller services that the user may not have had read access to.
How can I fix CVE-2019-10083?
To fix CVE-2019-10083, update NiFi to a version higher than 1.9.2.
Where can I find more information about CVE-2019-10083?
More information about CVE-2019-10083 can be found at the references: [https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E](https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E) and [https://nifi.apache.org/security.html#CVE-2019-10083](https://nifi.apache.org/security.html#CVE-2019-10083).