CVE-2024-45477: Apache NiFi: Improper Neutralization of Input in Parameter Description
Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.28.0 or 2.0.0-M4 is the recommended mitigation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45477?
CVE-2024-45477 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2024-45477?
To mitigate CVE-2024-45477, upgrade your Apache NiFi installation to version 1.28.0 or 2.0.0-M4 or later.
Which versions of Apache NiFi are affected by CVE-2024-45477?
CVE-2024-45477 affects Apache NiFi versions from 1.10.0 to 1.27.0 and from 2.0.0-M1 to 2.0.0-M3.
What type of vulnerability is CVE-2024-45477?
CVE-2024-45477 is a cross-site scripting vulnerability that allows an authenticated user to inject malicious JavaScript.
Who is at risk from CVE-2024-45477?
Authenticated users who can configure Parameter Contexts in affected versions of Apache NiFi are at risk from CVE-2024-45477.