Skip to content
fr Sign in
4.6 Medium

CVE-2024-37389 Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context…

Description

Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation.

Affected products and versions

Product Affected versions Fixed in
Apache NiFi 2.0 2.0.0-M1 → 2.0.0-M3 No fix stated
Apache NiFi 1.10 1.10.0 → 1.26.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache NiFi

The 47 CVEs of Apache NiFi →
CVE-2026-70469 Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests… Not rated CVE-2026-81866 Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not… 0.5 Low CVE-2026-82561 Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a… 5.9 Medium CVE-2026-86089 Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API… 2.3 Low
Track this CVE