CVE-2020-1928: Infoleak
First published: Tue Jan 28 2020(Updated: )
An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.nifi:nifi-parameter | =1.10.0 | 1.11.0 |
| Apache NiFi | =1.10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2020-1928
- https://github.com/apache/nifi/commit/42cb6e84898e66672878f61f99543d6af3c0a567
- https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e@%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1@%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b@%3Cusers.tomcat.apache.org%3E
- https://nifi.apache.org/security.html#CVE-2020-1928
- https://github.com/apache/nifi/pull/3935
- https://github.com/advisories/GHSA-w4fj-ccr6-7pcp (Advisory)
- https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1%40%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e%40%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b%40%3Cusers.tomcat.apache.org%3E
Frequently Asked Questions
What is CVE-2020-1928?
CVE-2020-1928 is an information disclosure vulnerability found in Apache NiFi 1.10.0.
How severe is CVE-2020-1928?
CVE-2020-1928 has a severity rating of 5.3 (medium).
What software versions are affected by CVE-2020-1928?
Apache NiFi 1.10.0 is affected by CVE-2020-1928.
How do I fix CVE-2020-1928?
To fix CVE-2020-1928, upgrade to Apache NiFi 1.11.0.
Are there any references for CVE-2020-1928?
Yes, you can find references for CVE-2020-1928 at the following links: [1](https://nvd.nist.gov/vuln/detail/CVE-2020-1928), [2](https://github.com/apache/nifi/commit/42cb6e84898e66672878f61f99543d6af3c0a567), [3](https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e@%3Cusers.tomcat.apache.org%3E).
- collector/github-advisory-latest
- alias/GHSA-w4fj-ccr6-7pcp
- alias/CVE-2020-1928
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/references
- agent/last-modified-date
- agent/description
- agent/event
- agent/first-publish-date
- agent/trending
- agent/tags
- agent/source
- package-manager/maven
- vendor/apache
- canonical/apache nifi
- version/apache nifi/1.10.0