Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/196692?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/196692?format=api", "purl": "pkg:maven/org.apache.nifi/nifi@1.9.1", "type": "maven", "namespace": "org.apache.nifi", "name": "nifi", "version": "1.9.1", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "1.24.0", "latest_non_vulnerable_version": "1.24.0", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/52506?format=api", "vulnerability_id": "VCID-2ema-4jrp-3kfr", "summary": "Inadequate Encryption Strength in Apache NiFi\nIn Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-9491", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0132", "scoring_system": "epss", "scoring_elements": "0.79823", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.0132", "scoring_system": "epss", "scoring_elements": "0.79905", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.0132", "scoring_system": "epss", "scoring_elements": "0.79902", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.0132", "scoring_system": "epss", "scoring_elements": "0.79901", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.0132", "scoring_system": "epss", "scoring_elements": "0.79872", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.0132", "scoring_system": "epss", "scoring_elements": "0.7988", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.0132", "scoring_system": "epss", "scoring_elements": "0.79897", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.0132", "scoring_system": "epss", "scoring_elements": "0.79876", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.0132", "scoring_system": "epss", "scoring_elements": "0.79868", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.0132", "scoring_system": "epss", "scoring_elements": "0.7984", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.0132", "scoring_system": "epss", "scoring_elements": "0.79852", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.0132", "scoring_system": "epss", "scoring_elements": "0.7983", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-9491" }, { "reference_url": "https://github.com/apache/nifi", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi" }, { "reference_url": "https://github.com/apache/nifi/commit/441781cec50f77d9f1e65093f55bbd614b8c5ec6", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi/commit/441781cec50f77d9f1e65093f55bbd614b8c5ec6" }, { "reference_url": "https://lists.apache.org/thread.html/r2d9c21f9ec35d66f2bb42f8abe876dabd786166b6284e9a33582c718@%3Ccommits.nifi.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/r2d9c21f9ec35d66f2bb42f8abe876dabd786166b6284e9a33582c718@%3Ccommits.nifi.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/re48582efe2ac973f8cff55c8b346825cb491c71935e15ab2d61ef3bf@%3Ccommits.nifi.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/re48582efe2ac973f8cff55c8b346825cb491c71935e15ab2d61ef3bf@%3Ccommits.nifi.apache.org%3E" }, { "reference_url": "https://nifi.apache.org/security#CVE-2020-9491", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nifi.apache.org/security#CVE-2020-9491" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9491", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9491" }, { "reference_url": "https://github.com/advisories/GHSA-rfmp-jvr7-hx78", "reference_id": "GHSA-rfmp-jvr7-hx78", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-rfmp-jvr7-hx78" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/80226?format=api", "purl": "pkg:maven/org.apache.nifi/nifi@1.12.0-RC1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.12.0-RC1" }, { "url": "http://public2.vulnerablecode.io/api/packages/215703?format=api", "purl": "pkg:maven/org.apache.nifi/nifi@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3eka-p4cs-f3dz" }, { "vulnerability": "VCID-4uja-72yx-6qdc" }, { "vulnerability": "VCID-bpqd-tx8f-kycf" }, { "vulnerability": "VCID-ec58-s3nd-7yaz" }, { "vulnerability": "VCID-g74u-zmqj-gyb7" }, { "vulnerability": "VCID-hy35-v2p5-2ycq" }, { "vulnerability": "VCID-rn4r-36ab-sfey" }, { "vulnerability": "VCID-rv8f-q4a4-xqbk" }, { "vulnerability": "VCID-xhjy-xmhq-abh7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.12.0" } ], "aliases": [ "CVE-2020-9491", "GHSA-rfmp-jvr7-hx78" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2ema-4jrp-3kfr" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/17849?format=api", "vulnerability_id": "VCID-3eka-p4cs-f3dz", "summary": "Apache NiFi vulnerable to Code Injection\nThe DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.\n\nThe resolution validates the Database URL and rejects H2 JDBC locations.\n\nYou are recommended to upgrade to version 1.22.0 or later which fixes this issue.", "references": [ { "reference_url": "http://packetstormsecurity.com/files/174398/Apache-NiFi-H2-Connection-String-Remote-Code-Execution.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-08T20:21:50Z/" } ], "url": "http://packetstormsecurity.com/files/174398/Apache-NiFi-H2-Connection-String-Remote-Code-Execution.html" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-34468", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.77205", "scoring_system": "epss", "scoring_elements": "0.98975", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.77205", "scoring_system": "epss", "scoring_elements": "0.98965", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.77205", "scoring_system": "epss", "scoring_elements": "0.98967", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.77205", "scoring_system": "epss", "scoring_elements": "0.98969", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.77205", "scoring_system": "epss", "scoring_elements": "0.98971", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.77205", "scoring_system": "epss", "scoring_elements": "0.98972", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.77205", "scoring_system": "epss", "scoring_elements": "0.98973", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.77205", "scoring_system": "epss", "scoring_elements": "0.98974", "published_at": "2026-04-16T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-34468" }, { "reference_url": "https://exceptionfactory.com/posts/2023/10/07/firsthand-analysis-of-apache-nifi-vulnerability-cve-2023-34468", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://exceptionfactory.com/posts/2023/10/07/firsthand-analysis-of-apache-nifi-vulnerability-cve-2023-34468" }, { "reference_url": "https://github.com/apache/nifi", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi" }, { "reference_url": "https://github.com/apache/nifi/commit/4faf3ea59895e7e153db3f8f61147ff70a254361", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi/commit/4faf3ea59895e7e153db3f8f61147ff70a254361" }, { "reference_url": "https://github.com/apache/nifi/pull/7349", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi/pull/7349" }, { "reference_url": "https://issues.apache.org/jira/browse/NIFI-11653", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.apache.org/jira/browse/NIFI-11653" }, { "reference_url": "https://lists.apache.org/thread/7b82l4f5blmpkfcynf3y6z4x1vqo59h8", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-08T20:21:50Z/" } ], "url": "https://lists.apache.org/thread/7b82l4f5blmpkfcynf3y6z4x1vqo59h8" }, { "reference_url": "https://nifi.apache.org/security.html#CVE-2023-34468", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-08T20:21:50Z/" } ], "url": "https://nifi.apache.org/security.html#CVE-2023-34468" }, { "reference_url": "https://www.cyfirma.com/outofband/apache-nifi-cve-2023-34468-rce-vulnerability-analysis-and-exploitation", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.cyfirma.com/outofband/apache-nifi-cve-2023-34468-rce-vulnerability-analysis-and-exploitation" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2023/06/12/3", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-08T20:21:50Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2023/06/12/3" }, { "reference_url": "https://www.cyfirma.com/outofband/apache-nifi-cve-2023-34468-rce-vulnerability-analysis-and-exploitation/", "reference_id": "apache-nifi-cve-2023-34468-rce-vulnerability-analysis-and-exploitation", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-08T20:21:50Z/" } ], "url": "https://www.cyfirma.com/outofband/apache-nifi-cve-2023-34468-rce-vulnerability-analysis-and-exploitation/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34468", "reference_id": "CVE-2023-34468", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34468" }, { "reference_url": "https://github.com/advisories/GHSA-xm2m-2q6h-22jw", "reference_id": "GHSA-xm2m-2q6h-22jw", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xm2m-2q6h-22jw" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57917?format=api", "purl": "pkg:maven/org.apache.nifi/nifi@1.22.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hy35-v2p5-2ycq" }, { "vulnerability": "VCID-rv8f-q4a4-xqbk" }, { "vulnerability": "VCID-ues1-6z47-q7hc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.22.0" } ], "aliases": [ "CVE-2023-34468", "GHSA-xm2m-2q6h-22jw" ], "risk_score": 10.0, "exploitability": "2.0", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3eka-p4cs-f3dz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/17846?format=api", "vulnerability_id": "VCID-4uja-72yx-6qdc", "summary": "Deserialization of Untrusted Data\nThe JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.\n\nThe resolution validates the JNDI URL and restricts locations to a set of allowed schemes.\n\nYou are recommended to upgrade to version 1.22.0 or later which fixes this issue.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-34212", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00779", "scoring_system": "epss", "scoring_elements": "0.73667", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00779", "scoring_system": "epss", "scoring_elements": "0.73654", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00779", "scoring_system": "epss", "scoring_elements": "0.73716", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00779", "scoring_system": "epss", "scoring_elements": "0.73707", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00779", "scoring_system": "epss", "scoring_elements": "0.73663", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00779", "scoring_system": "epss", "scoring_elements": "0.73672", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00779", "scoring_system": "epss", "scoring_elements": "0.73689", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00909", "scoring_system": "epss", "scoring_elements": "0.75748", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00909", "scoring_system": "epss", "scoring_elements": "0.75759", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00909", "scoring_system": "epss", "scoring_elements": "0.7578", "published_at": "2026-04-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-34212" }, { "reference_url": "https://github.com/apache/nifi", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi" }, { "reference_url": "https://github.com/apache/nifi/commit/3fcb82ee4509d1ad73893d8dca003be6d086c5d6", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi/commit/3fcb82ee4509d1ad73893d8dca003be6d086c5d6" }, { "reference_url": "https://github.com/apache/nifi/pull/7313", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi/pull/7313" }, { "reference_url": "https://issues.apache.org/jira/browse/NIFI-11614", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.apache.org/jira/browse/NIFI-11614" }, { "reference_url": "https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-09T13:37:27Z/" } ], "url": "https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5" }, { "reference_url": "https://nifi.apache.org/security.html#CVE-2023-34212", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-09T13:37:27Z/" } ], "url": "https://nifi.apache.org/security.html#CVE-2023-34212" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2023/06/12/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-09T13:37:27Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2023/06/12/2" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34212", "reference_id": "CVE-2023-34212", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34212" }, { "reference_url": "https://github.com/advisories/GHSA-65wh-g8x8-gm2h", "reference_id": "GHSA-65wh-g8x8-gm2h", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-65wh-g8x8-gm2h" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57917?format=api", "purl": "pkg:maven/org.apache.nifi/nifi@1.22.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hy35-v2p5-2ycq" }, { "vulnerability": "VCID-rv8f-q4a4-xqbk" }, { "vulnerability": "VCID-ues1-6z47-q7hc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.22.0" } ], "aliases": [ "CVE-2023-34212", "GHSA-65wh-g8x8-gm2h" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4uja-72yx-6qdc" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50560?format=api", "vulnerability_id": "VCID-4v3d-ugqf-uyag", "summary": "Apache NiFi information disclosure by XXE\nThe XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-10080", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00418", "scoring_system": "epss", "scoring_elements": "0.61813", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00418", "scoring_system": "epss", "scoring_elements": "0.61656", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00418", "scoring_system": "epss", "scoring_elements": "0.6173", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00418", "scoring_system": "epss", "scoring_elements": "0.6176", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00418", "scoring_system": "epss", "scoring_elements": "0.61779", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00418", "scoring_system": "epss", "scoring_elements": "0.61794", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00418", "scoring_system": "epss", "scoring_elements": "0.61815", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00418", "scoring_system": "epss", "scoring_elements": "0.61802", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00418", "scoring_system": "epss", "scoring_elements": "0.61783", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00418", "scoring_system": "epss", "scoring_elements": "0.61825", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00418", "scoring_system": "epss", "scoring_elements": "0.6183", "published_at": "2026-04-18T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-10080" }, { "reference_url": "https://github.com/apache/nifi/pull/3507", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi/pull/3507" }, { "reference_url": "https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E" }, { "reference_url": "https://nifi.apache.org/security.html#CVE-2019-10080", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nifi.apache.org/security.html#CVE-2019-10080" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10080", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:L/Au:S/C:P/I:N/A:N" }, { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10080" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuApr2021.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*" }, { "reference_url": "https://github.com/advisories/GHSA-744r-vv2g-2x6g", "reference_id": "GHSA-744r-vv2g-2x6g", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-744r-vv2g-2x6g" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/78830?format=api", "purl": "pkg:maven/org.apache.nifi/nifi@1.10.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ema-4jrp-3kfr" }, { "vulnerability": "VCID-3eka-p4cs-f3dz" }, { "vulnerability": "VCID-4uja-72yx-6qdc" }, { "vulnerability": "VCID-bppj-knks-jybe" }, { "vulnerability": "VCID-bpqd-tx8f-kycf" }, { "vulnerability": "VCID-ec58-s3nd-7yaz" }, { "vulnerability": "VCID-g74u-zmqj-gyb7" }, { "vulnerability": "VCID-gqjq-sbf1-x7ew" }, { "vulnerability": "VCID-hy35-v2p5-2ycq" }, { "vulnerability": "VCID-rn4r-36ab-sfey" }, { "vulnerability": "VCID-rv8f-q4a4-xqbk" }, { "vulnerability": "VCID-xhjy-xmhq-abh7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.10.0" } ], "aliases": [ "CVE-2019-10080", "GHSA-744r-vv2g-2x6g" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4v3d-ugqf-uyag" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/52510?format=api", "vulnerability_id": "VCID-bppj-knks-jybe", "summary": "Improper Restriction of XML External Entity Reference in Apache NiFi\nIn Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-13940", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76501", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76423", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76455", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76469", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76495", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76473", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76509", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76513", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.7641", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76413", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76441", "published_at": "2026-04-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-13940" }, { "reference_url": "https://github.com/apache/nifi/commit/7f0416ee8bdcee95e28409cc6fae9c1394c2a798", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi/commit/7f0416ee8bdcee95e28409cc6fae9c1394c2a798" }, { "reference_url": "https://nifi.apache.org/security#CVE-2020-13940", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nifi.apache.org/security#CVE-2020-13940" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13940", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13940" }, { "reference_url": "https://github.com/advisories/GHSA-q4xf-3pmq-3hw8", "reference_id": "GHSA-q4xf-3pmq-3hw8", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-q4xf-3pmq-3hw8" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/80226?format=api", "purl": "pkg:maven/org.apache.nifi/nifi@1.12.0-RC1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.12.0-RC1" }, { "url": "http://public2.vulnerablecode.io/api/packages/215703?format=api", "purl": "pkg:maven/org.apache.nifi/nifi@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3eka-p4cs-f3dz" }, { "vulnerability": "VCID-4uja-72yx-6qdc" }, { "vulnerability": "VCID-bpqd-tx8f-kycf" }, { "vulnerability": "VCID-ec58-s3nd-7yaz" }, { "vulnerability": "VCID-g74u-zmqj-gyb7" }, { "vulnerability": "VCID-hy35-v2p5-2ycq" }, { "vulnerability": "VCID-rn4r-36ab-sfey" }, { "vulnerability": "VCID-rv8f-q4a4-xqbk" }, { "vulnerability": "VCID-xhjy-xmhq-abh7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.12.0" } ], "aliases": [ "CVE-2020-13940", "GHSA-q4xf-3pmq-3hw8" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bppj-knks-jybe" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/14007?format=api", "vulnerability_id": "VCID-bpqd-tx8f-kycf", "summary": "Improper Restriction of XML External Entity Reference\nMultiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted XML files. The following Processors attempt to resolve XML External Entity references when configured with default property values: - `EvaluateXPath` - `EvaluateXQuery` - `ValidateXml` Apache NiFi flow configurations that include these Processors is vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations in the default configuration for these Processors, and disallows XML External Entity resolution in standard services.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-29265", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0212", "scoring_system": "epss", "scoring_elements": "0.84164", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.0212", "scoring_system": "epss", "scoring_elements": "0.84098", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.0212", "scoring_system": "epss", "scoring_elements": "0.841", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.0212", "scoring_system": "epss", "scoring_elements": "0.84123", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.0212", "scoring_system": "epss", "scoring_elements": "0.84129", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.0212", "scoring_system": "epss", "scoring_elements": "0.84146", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.0212", "scoring_system": "epss", "scoring_elements": "0.84141", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.0212", "scoring_system": "epss", "scoring_elements": "0.84136", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.0212", "scoring_system": "epss", "scoring_elements": "0.84159", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.0212", "scoring_system": "epss", "scoring_elements": "0.8416", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.0212", "scoring_system": "epss", "scoring_elements": "0.84081", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-29265" }, { "reference_url": "https://github.com/apache/nifi", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi" }, { "reference_url": "https://lists.apache.org/thread/47od9kr9n4cyv0mv81jh3pkyx815kyjl", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread/47od9kr9n4cyv0mv81jh3pkyx815kyjl" }, { "reference_url": "https://nifi.apache.org/security.html#CVE-2022-29265", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nifi.apache.org/security.html#CVE-2022-29265" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29265", "reference_id": "CVE-2022-29265", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29265" }, { "reference_url": "https://github.com/advisories/GHSA-wc97-7623-rxwx", "reference_id": "GHSA-wc97-7623-rxwx", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-wc97-7623-rxwx" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/50091?format=api", "purl": "pkg:maven/org.apache.nifi/nifi@1.16.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3eka-p4cs-f3dz" }, { "vulnerability": "VCID-4uja-72yx-6qdc" }, { "vulnerability": "VCID-g74u-zmqj-gyb7" }, { "vulnerability": "VCID-hy35-v2p5-2ycq" }, { "vulnerability": "VCID-rv8f-q4a4-xqbk" }, { "vulnerability": "VCID-xhjy-xmhq-abh7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.16.1" } ], "aliases": [ "CVE-2022-29265", "GHSA-wc97-7623-rxwx" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bpqd-tx8f-kycf" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36316?format=api", "vulnerability_id": "VCID-ec58-s3nd-7yaz", "summary": "Deserialization of untrusted data in jackson-databind\nA flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20190.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20190.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-20190", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00502", "scoring_system": "epss", "scoring_elements": "0.66101", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00502", "scoring_system": "epss", "scoring_elements": "0.66087", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00502", "scoring_system": "epss", "scoring_elements": "0.66052", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00502", "scoring_system": "epss", "scoring_elements": "0.66082", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00502", "scoring_system": "epss", "scoring_elements": "0.66094", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00502", "scoring_system": "epss", "scoring_elements": "0.66075", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00502", "scoring_system": "epss", "scoring_elements": "0.66063", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00502", "scoring_system": "epss", "scoring_elements": "0.66014", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00502", "scoring_system": "epss", "scoring_elements": "0.66047", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00502", "scoring_system": "epss", "scoring_elements": "0.66018", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00502", "scoring_system": "epss", "scoring_elements": "0.65976", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00633", "scoring_system": "epss", "scoring_elements": "0.70382", "published_at": "2026-04-21T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-20190" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916633", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-08-27T20:35:59Z/" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916633" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20190", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20190" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/FasterXML/jackson-databind", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FasterXML/jackson-databind" }, { "reference_url": "https://github.com/FasterXML/jackson-databind/commit/08fbfacf89a4a4c026a6227a1b470ab7a13e2e88", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FasterXML/jackson-databind/commit/08fbfacf89a4a4c026a6227a1b470ab7a13e2e88" }, { "reference_url": "https://github.com/FasterXML/jackson-databind/commit/7dbf51bf78d157098074a20bd9da39bd48c18e4a", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FasterXML/jackson-databind/commit/7dbf51bf78d157098074a20bd9da39bd48c18e4a" }, { "reference_url": "https://github.com/FasterXML/jackson-databind/issues/2854", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-08-27T20:35:59Z/" } ], "url": "https://github.com/FasterXML/jackson-databind/issues/2854" }, { "reference_url": "https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a@%3Ccommits.nifi.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a@%3Ccommits.nifi.apache.org%3E" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-08-27T20:35:59Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20190", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20190" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210219-0008", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20210219-0008" }, { "reference_url": "https://www.oracle.com//security-alerts/cpujul2021.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-08-27T20:35:59Z/" } ], "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "reference_url": "https://github.com/advisories/GHSA-5949-rw7g-wx7w", "reference_id": "GHSA-5949-rw7g-wx7w", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-5949-rw7g-wx7w" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210219-0008/", "reference_id": "ntap-20210219-0008", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-08-27T20:35:59Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20210219-0008/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:1230", "reference_id": "RHSA-2021:1230", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:1230" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:1515", "reference_id": "RHSA-2021:1515", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:1515" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/224800?format=api", "purl": "pkg:maven/org.apache.nifi/nifi@1.13.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3eka-p4cs-f3dz" }, { "vulnerability": "VCID-4uja-72yx-6qdc" }, { "vulnerability": "VCID-bpqd-tx8f-kycf" }, { "vulnerability": "VCID-g74u-zmqj-gyb7" }, { "vulnerability": "VCID-hy35-v2p5-2ycq" }, { "vulnerability": "VCID-rn4r-36ab-sfey" }, { "vulnerability": "VCID-rv8f-q4a4-xqbk" }, { "vulnerability": "VCID-uuju-ey95-tyfq" }, { "vulnerability": "VCID-xhjy-xmhq-abh7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.13.0" } ], "aliases": [ "CVE-2021-20190", "GHSA-5949-rw7g-wx7w" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ec58-s3nd-7yaz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/16397?format=api", "vulnerability_id": "VCID-g74u-zmqj-gyb7", "summary": "XML External Entity Reference in Apache NiFi\nThe ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-22832", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.02041", "scoring_system": "epss", "scoring_elements": "0.83866", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.02041", "scoring_system": "epss", "scoring_elements": "0.83783", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.02041", "scoring_system": "epss", "scoring_elements": "0.83797", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.02041", "scoring_system": "epss", "scoring_elements": "0.83798", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.02041", "scoring_system": "epss", "scoring_elements": "0.83822", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.02041", "scoring_system": "epss", "scoring_elements": "0.83828", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.02041", "scoring_system": "epss", "scoring_elements": "0.83844", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.02041", "scoring_system": "epss", "scoring_elements": "0.83837", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.02041", "scoring_system": "epss", "scoring_elements": "0.83833", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.02041", "scoring_system": "epss", "scoring_elements": "0.83867", "published_at": "2026-04-18T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-22832" }, { "reference_url": "https://github.com/apache/nifi", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi" }, { "reference_url": "https://github.com/apache/nifi/commit/e966336e8966cf0cbbd12a2c4f2d73a7ceb75cd8", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi/commit/e966336e8966cf0cbbd12a2c4f2d73a7ceb75cd8" }, { "reference_url": "https://lists.apache.org/thread/b51qs6y7b7r58vovddkv6wc16g2xbl3w", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-24T16:28:56Z/" } ], "url": "https://lists.apache.org/thread/b51qs6y7b7r58vovddkv6wc16g2xbl3w" }, { "reference_url": "https://nifi.apache.org/security.html#CVE-2023-22832", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-24T16:28:56Z/" } ], "url": "https://nifi.apache.org/security.html#CVE-2023-22832" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22832", "reference_id": "CVE-2023-22832", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22832" }, { "reference_url": "https://github.com/advisories/GHSA-hxjp-q6c3-38fx", "reference_id": "GHSA-hxjp-q6c3-38fx", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-hxjp-q6c3-38fx" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/355490?format=api", "purl": "pkg:maven/org.apache.nifi/nifi@1.20.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3eka-p4cs-f3dz" }, { "vulnerability": "VCID-4uja-72yx-6qdc" }, { "vulnerability": "VCID-hy35-v2p5-2ycq" }, { "vulnerability": "VCID-rv8f-q4a4-xqbk" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.20.0" } ], "aliases": [ "CVE-2023-22832", "GHSA-hxjp-q6c3-38fx" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-g74u-zmqj-gyb7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/52447?format=api", "vulnerability_id": "VCID-gqjq-sbf1-x7ew", "summary": "Cross-site scripting in Apache NiFi\nA XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-1933", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00485", "scoring_system": "epss", "scoring_elements": "0.65371", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00485", "scoring_system": "epss", "scoring_elements": "0.6535", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00485", "scoring_system": "epss", "scoring_elements": "0.65362", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00485", "scoring_system": "epss", "scoring_elements": "0.65381", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00485", "scoring_system": "epss", "scoring_elements": "0.65368", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00485", "scoring_system": "epss", "scoring_elements": "0.6534", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00485", "scoring_system": "epss", "scoring_elements": "0.65376", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00485", "scoring_system": "epss", "scoring_elements": "0.65387", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00485", "scoring_system": "epss", "scoring_elements": "0.65259", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00485", "scoring_system": "epss", "scoring_elements": "0.65309", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00485", "scoring_system": "epss", "scoring_elements": "0.65334", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00485", "scoring_system": "epss", "scoring_elements": "0.65298", "published_at": "2026-04-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-1933" }, { "reference_url": "https://github.com/apache/nifi/pull/3991", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi/pull/3991" }, { "reference_url": "https://nifi.apache.org/security.html#CVE-2020-1933", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nifi.apache.org/security.html#CVE-2020-1933" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1933", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1933" }, { "reference_url": "https://github.com/advisories/GHSA-pqhq-xx62-2v2p", "reference_id": "GHSA-pqhq-xx62-2v2p", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-pqhq-xx62-2v2p" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/80194?format=api", "purl": "pkg:maven/org.apache.nifi/nifi@1.11.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ema-4jrp-3kfr" }, { "vulnerability": "VCID-3eka-p4cs-f3dz" }, { "vulnerability": "VCID-4uja-72yx-6qdc" }, { "vulnerability": "VCID-bppj-knks-jybe" }, { "vulnerability": "VCID-bpqd-tx8f-kycf" }, { "vulnerability": "VCID-ec58-s3nd-7yaz" }, { "vulnerability": "VCID-g74u-zmqj-gyb7" }, { "vulnerability": "VCID-hy35-v2p5-2ycq" }, { "vulnerability": "VCID-rn4r-36ab-sfey" }, { "vulnerability": "VCID-rv8f-q4a4-xqbk" }, { "vulnerability": "VCID-xhjy-xmhq-abh7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.11.0" } ], "aliases": [ "CVE-2020-1933", "GHSA-pqhq-xx62-2v2p" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gqjq-sbf1-x7ew" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/19954?format=api", "vulnerability_id": "VCID-hy35-v2p5-2ycq", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nApache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary\nJavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0-M1 is the recommended mitigation.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-49145", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00293", "scoring_system": "epss", "scoring_elements": "0.52552", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00293", "scoring_system": "epss", "scoring_elements": "0.52641", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00293", "scoring_system": "epss", "scoring_elements": "0.52656", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00293", "scoring_system": "epss", "scoring_elements": "0.52649", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00293", "scoring_system": "epss", "scoring_elements": "0.5261", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00293", "scoring_system": "epss", "scoring_elements": "0.52625", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00293", "scoring_system": "epss", "scoring_elements": "0.52642", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00293", "scoring_system": "epss", "scoring_elements": "0.52545", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00293", "scoring_system": "epss", "scoring_elements": "0.52578", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00293", "scoring_system": "epss", "scoring_elements": "0.52591", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00293", "scoring_system": "epss", "scoring_elements": "0.52597", "published_at": "2026-04-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-49145" }, { "reference_url": "https://github.com/apache/nifi", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi" }, { "reference_url": "https://github.com/apache/nifi/commit/50efc55df6bb00ea15adcc2459d5cc82d128857f", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi/commit/50efc55df6bb00ea15adcc2459d5cc82d128857f" }, { "reference_url": "https://github.com/apache/nifi/pull/8060", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi/pull/8060" }, { "reference_url": "https://issues.apache.org/jira/browse/NIFI-12403", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.apache.org/jira/browse/NIFI-12403" }, { "reference_url": "https://lists.apache.org/thread/j8rd0qsvgoj0khqck5f49jfbp0fm8r1o", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread/j8rd0qsvgoj0khqck5f49jfbp0fm8r1o" }, { "reference_url": "https://nifi.apache.org/security.html#CVE-2023-49145", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nifi.apache.org/security.html#CVE-2023-49145" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2023/11/27/5", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2023/11/27/5" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49145", "reference_id": "CVE-2023-49145", "reference_type": "", "scores": [ { "value": "7.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49145" }, { "reference_url": "https://github.com/advisories/GHSA-68pr-6fjc-wmgm", "reference_id": "GHSA-68pr-6fjc-wmgm", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-68pr-6fjc-wmgm" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/61314?format=api", "purl": "pkg:maven/org.apache.nifi/nifi@1.24.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.24.0" } ], "aliases": [ "CVE-2023-49145", "GHSA-68pr-6fjc-wmgm" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hy35-v2p5-2ycq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/11880?format=api", "vulnerability_id": "VCID-rn4r-36ab-sfey", "summary": "Exposure of Sensitive Information to an Unauthorized Actor\nIn the TransformXML processor of Apache NiFi an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-44145", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00315", "scoring_system": "epss", "scoring_elements": "0.54612", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00315", "scoring_system": "epss", "scoring_elements": "0.54625", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00315", "scoring_system": "epss", "scoring_elements": "0.5462", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00315", "scoring_system": "epss", "scoring_elements": "0.54633", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00315", "scoring_system": "epss", "scoring_elements": "0.54616", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00315", "scoring_system": "epss", "scoring_elements": "0.54595", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00315", "scoring_system": "epss", "scoring_elements": "0.54632", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00315", "scoring_system": "epss", "scoring_elements": "0.54634", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00315", "scoring_system": "epss", "scoring_elements": "0.54509", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00315", "scoring_system": "epss", "scoring_elements": "0.54581", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00315", "scoring_system": "epss", "scoring_elements": "0.54605", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00315", "scoring_system": "epss", "scoring_elements": "0.54574", "published_at": "2026-04-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-44145" }, { "reference_url": "https://nifi.apache.org/security.html#1.15.1-vulnerabilities", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nifi.apache.org/security.html#1.15.1-vulnerabilities" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/12/17/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2021/12/17/1" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44145", "reference_id": "CVE-2021-44145", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44145" }, { "reference_url": "https://github.com/advisories/GHSA-rq96-qhc5-vm4r", "reference_id": "GHSA-rq96-qhc5-vm4r", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-rq96-qhc5-vm4r" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/42521?format=api", "purl": "pkg:maven/org.apache.nifi/nifi@1.15.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3eka-p4cs-f3dz" }, { "vulnerability": "VCID-4uja-72yx-6qdc" }, { "vulnerability": "VCID-bpqd-tx8f-kycf" }, { "vulnerability": "VCID-dmw5-6pw6-j3d6" }, { "vulnerability": "VCID-g74u-zmqj-gyb7" }, { "vulnerability": "VCID-hy35-v2p5-2ycq" }, { "vulnerability": "VCID-rv8f-q4a4-xqbk" }, { "vulnerability": "VCID-xhjy-xmhq-abh7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.15.1" } ], "aliases": [ "CVE-2021-44145", "GHSA-rq96-qhc5-vm4r" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rn4r-36ab-sfey" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/18547?format=api", "vulnerability_id": "VCID-rv8f-q4a4-xqbk", "summary": "Apache NiFi Code Injection vulnerability\nApache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-36542", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76419", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76515", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76479", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76501", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76475", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76461", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76429", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76448", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76507", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.0096", "scoring_system": "epss", "scoring_elements": "0.76519", "published_at": "2026-04-18T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-36542" }, { "reference_url": "http://seclists.org/fulldisclosure/2023/Jul/43", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-03T13:50:05Z/" } ], "url": "http://seclists.org/fulldisclosure/2023/Jul/43" }, { "reference_url": "https://github.com/apache/nifi", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi" }, { "reference_url": "https://github.com/apache/nifi/commit/532578799c", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/nifi/commit/532578799c" }, { "reference_url": "https://issues.apache.org/jira/browse/NIFI-11744", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.apache.org/jira/browse/NIFI-11744" }, { "reference_url": "https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-03T13:50:05Z/" } ], "url": "https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof" }, { "reference_url": "https://nifi.apache.org/security.html#CVE-2023-36542", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-03T13:50:05Z/" } ], "url": "https://nifi.apache.org/security.html#CVE-2023-36542" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2023/07/29/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-03T13:50:05Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2023/07/29/1" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36542", "reference_id": "CVE-2023-36542", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36542" }, { "reference_url": "https://github.com/advisories/GHSA-r969-8v3h-23v9", "reference_id": "GHSA-r969-8v3h-23v9", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-r969-8v3h-23v9" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/59199?format=api", "purl": "pkg:maven/org.apache.nifi/nifi@1.23.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hy35-v2p5-2ycq" }, { "vulnerability": "VCID-ues1-6z47-q7hc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.23.0" } ], "aliases": [ "CVE-2023-36542", "GHSA-r969-8v3h-23v9" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rv8f-q4a4-xqbk" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50587?format=api", "vulnerability_id": "VCID-yrgr-3cv3-b3ff", "summary": "Apache NiFi process group information disclosure\nWhen updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-10083", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01188", "scoring_system": "epss", "scoring_elements": "0.78834", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.01188", "scoring_system": "epss", "scoring_elements": "0.7878", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.01188", "scoring_system": "epss", "scoring_elements": "0.78806", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.01188", "scoring_system": "epss", "scoring_elements": "0.78814", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.01188", "scoring_system": "epss", "scoring_elements": "0.78837", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.01188", "scoring_system": "epss", "scoring_elements": "0.7882", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.01188", "scoring_system": "epss", "scoring_elements": "0.7881", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.01188", "scoring_system": "epss", "scoring_elements": "0.78839", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.01188", "scoring_system": "epss", "scoring_elements": "0.78836", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.01188", "scoring_system": "epss", "scoring_elements": "0.7876", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.01188", "scoring_system": "epss", "scoring_elements": "0.78767", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.01188", "scoring_system": "epss", "scoring_elements": "0.78798", "published_at": "2026-04-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-10083" }, { "reference_url": "https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E" }, { "reference_url": "https://nifi.apache.org/security.html#CVE-2019-10083", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nifi.apache.org/security.html#CVE-2019-10083" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10083", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.0", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:L/Au:N/C:P/I:N/A:N" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10083" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*" }, { "reference_url": "https://github.com/advisories/GHSA-26p8-xrj2-mv53", "reference_id": "GHSA-26p8-xrj2-mv53", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-26p8-xrj2-mv53" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/78830?format=api", "purl": "pkg:maven/org.apache.nifi/nifi@1.10.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ema-4jrp-3kfr" }, { "vulnerability": "VCID-3eka-p4cs-f3dz" }, { "vulnerability": "VCID-4uja-72yx-6qdc" }, { "vulnerability": "VCID-bppj-knks-jybe" }, { "vulnerability": "VCID-bpqd-tx8f-kycf" }, { "vulnerability": "VCID-ec58-s3nd-7yaz" }, { "vulnerability": "VCID-g74u-zmqj-gyb7" }, { "vulnerability": "VCID-gqjq-sbf1-x7ew" }, { "vulnerability": "VCID-hy35-v2p5-2ycq" }, { "vulnerability": "VCID-rn4r-36ab-sfey" }, { "vulnerability": "VCID-rv8f-q4a4-xqbk" }, { "vulnerability": "VCID-xhjy-xmhq-abh7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.10.0" } ], "aliases": [ "CVE-2019-10083", "GHSA-26p8-xrj2-mv53" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-yrgr-3cv3-b3ff" } ], "fixing_vulnerabilities": [], "risk_score": "10.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.nifi/nifi@1.9.1" }