CVE-2024-37389: Apache NiFi: Improper Neutralization of Input in Parameter Context Description

Q: What is the severity of CVE-2024-37389?

The severity of CVE-2024-37389 is considered high due to the potential for cross-site scripting attacks.

Q: How do I fix CVE-2024-37389?

To fix CVE-2024-37389, upgrade to Apache NiFi version 1.27.0 or 2.0.0-M4.

Q: Who is affected by CVE-2024-37389?

CVE-2024-37389 affects Apache NiFi versions 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3.

Q: What type of vulnerability is CVE-2024-37389?

CVE-2024-37389 is a cross-site scripting (XSS) vulnerability.

Q: Can an unauthenticated user exploit CVE-2024-37389?

No, an authenticated user with permissions to configure Parameters Context can exploit CVE-2024-37389.

Published Jul 8, 2024

Updated

Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation.

Affected Software

17 affected componentsFixes available

maven/org.apache.nifi:nifi-web-ui>=2.0.0-M1<2.0.0-M4

2.0.0-M4

maven/org.apache.nifi:nifi-web-ui>=1.10.0<1.27.0

1.27.0

Apache nifi>=1.10.0<1.27.0

Apache nifi=2.0.0-milestone1

Apache nifi=2.0.0-milestone1-rc1

Apache nifi=2.0.0-milestone1-rc2

Apache nifi=2.0.0-milestone1-rc3

Apache nifi=2.0.0-milestone1-rc4

Apache nifi=2.0.0-milestone1-rc5

Apache nifi=2.0.0-milestone1-rc6

Apache nifi=2.0.0-milestone2

Apache nifi=2.0.0-milestone2-rc1

Apache nifi=2.0.0-milestone2-rc2

Apache nifi=2.0.0-milestone2-rc3

Apache nifi=2.0.0-milestone2-rc4

Apache nifi=2.0.0-milestone3

Apache nifi=2.0.0-milestone3-rc1

Event History

Jul 8, 2024

CVE Published

via MITRE·07:29 AM

Data Sourced

via MITRE·07:29 AM

DescriptionSeverityWeakness

Advisory Published

via GitHub·09:32 AM

Frequently Asked Questions

What is the severity of CVE-2024-37389?

The severity of CVE-2024-37389 is considered high due to the potential for cross-site scripting attacks.

How do I fix CVE-2024-37389?

To fix CVE-2024-37389, upgrade to Apache NiFi version 1.27.0 or 2.0.0-M4.

Who is affected by CVE-2024-37389?

CVE-2024-37389 affects Apache NiFi versions 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3.

What type of vulnerability is CVE-2024-37389?

CVE-2024-37389 is a cross-site scripting (XSS) vulnerability.

Can an unauthenticated user exploit CVE-2024-37389?