CVE-2019-12421: High severity apache nifi vulnerability
When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12421?
The severity of CVE-2019-12421 is high, with a severity score of 8.8.
How does CVE-2019-12421 impact NiFi versions 1.0.0 to 1.9.2?
When using an authentication mechanism other than PKI, logging out in NiFi versions 1.0.0 to 1.9.2 does not invalidate the authentication token on the server side, allowing the user's client-side token to be used for up to 12 hours after logging out.
Which versions of NiFi are affected by CVE-2019-12421?
NiFi versions 1.0.0 to 1.9.2 are affected by CVE-2019-12421.
How can I fix CVE-2019-12421?
To fix CVE-2019-12421, upgrade to NiFi version 1.10.0 or higher.
Where can I find more information about CVE-2019-12421?
More information about CVE-2019-12421 can be found at the following references: [NVD NIST](https://nvd.nist.gov/vuln/detail/CVE-2019-12421), [GitHub Pull Request](https://github.com/apache/nifi/pull/3362), [NiFi Security](https://nifi.apache.org/security.html#CVE-2019-12421).