Session Management Flaw in Apache NiFi Affects User Authentication

CVE-2019-12421

Summary

In Apache NiFi, an improper session management vulnerability allows an authentication token to remain valid on the client side even after the user has logged out. Specifically, in versions 1.0.0 to 1.9.2, if an authentication mechanism other than PKI is utilized, logging out only invalidates the token on the client side. This means that the client-side token can be exploited to make API requests for up to 12 hours post logout, creating a substantial risk of unauthorized access.

References