CVE-2023-49145: Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt
Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0-M1 is the recommended mitigation.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Apache NiFi vulnerability?
The vulnerability ID for this Apache NiFi vulnerability is CVE-2023-49145.
What is the title of the vulnerability?
The title of the vulnerability is 'Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt'.
What is the severity rating of CVE-2023-49145?
CVE-2023-49145 has a severity rating of 7.9 (high).
What is the affected software version range for this vulnerability?
Apache NiFi versions 0.7.0 through 1.23.2 are affected by this vulnerability.
How can I fix the Apache NiFi vulnerability CVE-2023-49145?
To fix this vulnerability, update Apache NiFi to version 1.24.0 or later.