CVE-2020-9487

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to cr...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Bitnami nifi

[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"last_affected":"1.11.4"}]}]

Références

advisory nifi.apache.org
web nvd.nist.gov