CVE-2025-27017
Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record
- State
- Published
- Severity
- 6.9 Medium
- Published
- Mar 12, 2025
- Updated
- Mar 12, 2025
- Reserved
- Feb 17, 2025
Description
Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials information. Upgrading to Apache NiFi 2.3.0 is the recommended mitigation, which removes the credentials from provenance event records.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:L/U:Green | apache |
Weaknesses
- CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
Affected Products
| Product | Versions |
|---|---|
Apache NiFiApache Software Foundation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.