Token Creation Vulnerability in Apache NiFi by Apache Software Foundation
CVE-2020-9487

7.5HIGH

Key Information:

Vendor
Apache
Status
Apache Nifi
Vendor
CVE Published:
1 October 2020

Summary

In Apache NiFi versions 1.0.0 through 1.11.4, a significant security issue exists whereby the token creation mechanism lacks sufficient request authentication. An attacker can exploit this flaw by repeatedly requesting download tokens without authentication. This can lead to a denial-of-service scenario for legitimate users, preventing them from obtaining necessary download tokens to access content securely. The vulnerability suggests the need for enhanced authentication measures to safeguard against unauthorized token requests.

Affected Version(s)

Apache NiFi Apache NiFi 1.0.0 to 1.11.4

References

https://nifi.apache.org/security#CVE-2020-9487
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.