Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt
Summary
Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt
Original description
The description as published by the source.
Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary
JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0 is the recommended mitigation.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
References
- advisory openwall.com
- advisory lists.apache.org
- advisory nifi.apache.org
- web nvd.nist.gov