Sensitive Data Exposure in Apache NiFi

CVE-2020-1942

What is CVE-2020-1942?

In versions 0.0.1 through 1.11.0 of Apache NiFi, sensitive property descriptor values could be inadvertently exposed through the flow fingerprint factory. If a node joins a cluster with a non-inheritable flow, both the local and cluster flow fingerprints could be outputted, potentially revealing sensitive information in plaintext. This vulnerability highlights the need for improved handling of property descriptors to prevent unintentional data leaks in distributed system environments.

References