Home > Vulnerability Database > CVE-2024-45477

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2024-45477

Good to know:

Date: October 29, 2024

Apache NiFi: Improper Neutralization of Input in Parameter Description

Language: Java

Severity Score

4.6

Related Resources (11)

Url: https://lists.apache.org/thread/shdv0tw9hggj7tx9pl7g93mgok2lwbj9

Url: https://seclists.org/oss-sec/2024/q4/41

Url: https://github.com/apache/nifi/commit/153c87a7daaeebea9b119066285b840ea4056e09

Url: https://nifi.apache.org/documentation/security/#CVE-2024-45477

Url: https://github.com/apache/nifi

Url: http://www.openwall.com/lists/oss-security/2024/10/28/1

Url: https://github.com/apache/nifi/blob/rel/nifi-1.27.0/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/canvas/nf-parameter-contexts.js#L2197

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-45477

Url: https://github.com/apache/nifi/pull/9195

Url: https://issues.apache.org/jira/browse/NIFI-13675

Url: https://www.mend.io/vulnerability-database/CVE-2024-45477

Severity Score

4.6

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

Improper Control of Generation of Code ('Code Injection')

CWE-94

Top Fix

Upgrade Version

Upgrade to version org.apache.nifi:nifi-web-ui:1.28.0

CVSS v3.1

Base Score:	4.6
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	REQUIRED
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	NONE

Do you need more information?

Contact Us