Riskcovery

CVE-2024-52067

Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log

State
Published
Severity
6.9 Medium
Published
Nov 21, 2024
Updated
Nov 21, 2024
Reserved
Nov 5, 2024

Read the record on cve.org

Description

Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causing the application to write Parameter names and values to the application log. Parameter Context values may contain sensitive information depending on application flow configuration. Deployments of Apache NiFi with the default Logback configuration do not log Parameter Context values. Upgrading to Apache NiFi 2.0.0 or 1.28.1 is the recommendation mitigation, eliminating Parameter value logging from the flow synchronization process regardless of the Logback configuration.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/AU:Y/R:U/V:D/RE:L/U:Greenapache

Weaknesses

  • CWE-532 Insertion of Sensitive Information into Log File

Affected Products

ProductVersions
Apache NiFiApache Software Foundation
  • 1.16.0 through 1.28.0Affected
  • 2.0.0-M1 through 2.0.0-M4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.