Sensitive information in log files in Apache NiFi
Priority LOW 31CWE-532Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-532.
Summary
An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.
Why it matters now
EPSS 0.03959 90th percentileScored 2026-11-07
Fix Fixed org.apache.nifi:nifi-parameter (Maven): 1.11.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache NiFi | Apache NiFi 1.10.0 | — | No fix listed | CNA |
| — | org.apache.nifi:nifi-parameter (Maven) | 1.10.0 to before 1.11.0 | 1.11.0 | Patch available | GHSA-w4fj-ccr6-7pcp |
- Apache NiFi VendorApache Affected Apache NiFi 1.10.0 Fixed in — No fix listed CNA
- org.apache.nifi:nifi-parameter (Maven) Vendor— Affected 1.10.0 to before 1.11.0 Fixed in 1.11.0 Patch available GHSA-w4fj-ccr6-7pcp
Remediation
- Fix · GHSA-w4fj-ccr6-7pcp org.apache.nifi:nifi-parameter (Maven) Fixed in 1.11.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1928
- 2026-10-03 Alias added: GHSA-w4fj-ccr6-7pcp
References
Advisory 2
Other 9
- [tomcat-users] 20200302 Re: AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution
- [tomcat-users] 20200302 AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution
- [tomcat-users] 20200302 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution
- https://github.com/apache/nifi/pull/3935
- https://github.com/apache/nifi/commit/42cb6e84898e66672878f61f99543d6af3c0a567
- https://github.com/apache/nifi
- https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e@%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1@%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b@%3Cusers.tomcat.apache.org%3E
More Apache Nifi vulnerabilities
- TI-2023-17293 Apache NiFi: Potential Code Injection with Database Services using H2 CVSS 3.1HIGH 8.8
- TI-2020-16549 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1MEDIUM 5.3
- TI-2019-07411 Deserialization of untrusted data in Apache Commons Beanutils CVSS 3.1HIGH 7.3
- TI-2017-11471 Improper input validation in Apache NiFi CVSS 3.0CRITICAL 9.8
- TI-2018-01212 XML external entity injection in Apache NiFi CVSS 3.0CRITICAL 9.8
- TI-2021-03489 Deserialization of untrusted data in jackson-databind CVSS 3.1HIGH 8.1
Sources
- CVE-2020-1928 · CVE Program
- CVE-2020-1928 · NVD
- FIRST EPSS
- GHSA-w4fj-ccr6-7pcp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences