oss-sec mailing list archives

[CVE-2020-1933] Apache NiFi XSS Attack

From: Nathan Gough <thenatog () apache org>
Date: Mon, 27 Jan 2020 12:08:03 -0500

[CVEID]:CVE-2020-1933

[PRODUCT]:Apache NiFi

[VERSION]:Apache NiFi 1.0.0 to 1.10.0

[PROBLEMTYPE]:XSS Attack

[REFERENCES]:https://nifi.apache.org/security.html#CVE-2020-1933

[DESCRIPTION]:As reported by Jakub Palaczynski (ING Tech Poland), malicious
scripts could be injected to the UI through action by an unaware
authenticated user in Firefox. Did not appear to occur in other browsers.

Current thread:

[CVE-2020-1933] Apache NiFi XSS Attack Nathan Gough (Jan 27)