Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt
Résumé
Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary
JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0 is the recommended mitigation.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Références
- advisory openwall.com
- advisory lists.apache.org
- advisory nifi.apache.org
- web nvd.nist.gov