Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt
概要
Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary
JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0 is the recommended mitigation.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
参照URL
- advisory openwall.com
- advisory lists.apache.org
- advisory nifi.apache.org
- web nvd.nist.gov