- Description
- Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causing the application to write Parameter names and values to the application log. Parameter Context values may contain sensitive information depending on application flow configuration. Deployments of Apache NiFi with the default Logback configuration do not log Parameter Context values. Upgrading to Apache NiFi 2.0.0 or 1.28.1 is the recommendation mitigation, eliminating Parameter value logging from the flow synchronization process regardless of the Logback configuration.
- Source
- security@apache.org
- NVD status
- Analyzed
CVSS 4.0
- Type
- Secondary
- Base score
- 6.9
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:L/U:Green
- Severity
- MEDIUM
CVSS 3.1
- Type
- Primary
- Base score
- 4.9
- Impact score
- 3.6
- Exploitability score
- 1.2
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Severity
- MEDIUM
- security@apache.org
- CWE-532
- Hype score
- Not currently trending
Apache NiFi の脆弱性 CVE-2024-52067 が FIX：デバッグ・ログへの機密データ漏洩の恐れ https://t.co/UrMo2092se #Apache #NiFi #OpenSource #Vulnerability
@iototsecnews
2 Dec 2024
148 Impressions
1 Retweet
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Threat Alert: CVE-2024-52067: Sensitive Data Exposed in Apache NiFi Debug Logs CVE-2024-52067 Severity: 🔴 High Maturity: 💢 Emerging Learn more: https://t.co/n1s6rDZdWE #CyberSecurity #ThreatIntel #InfoSec
@fletch_ai
23 Nov 2024
38 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2024-52067 Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An… https://t.co/fIftZONM9E
@CVEnew
21 Nov 2024
143 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2024-52067 Affected versions: - Apache NiFi 1.16.0 through 1.28.0 - Apache NiFi 2.0.0-M1 through 2.0.0-M4 Description: Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug ... https://t.co/ixRfm0nzE4
@VulmonFeeds
20 Nov 2024
12 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "65C9ADE4-A067-4445-9500-6A46B5C41599",
"versionEndExcluding": "1.28.1",
"versionStartIncluding": "1.16.0"
},
{
"criteria": "cpe:2.3:a:apache:nifi:2.0.0:milestone1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D147AF4C-74C3-41AE-B5A5-24051AC1458B"
},
{
"criteria": "cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8F5DBC6B-2239-4349-A836-EFB8BA720145"
},
{
"criteria": "cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B366BC5E-6845-40C3-9A2E-89BF99BC0C84"
},
{
"criteria": "cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "96565E7C-0CE5-439C-9B81-551DC0B7CB9D"
},
{
"criteria": "cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7547CA64-3DEC-4322-96CA-C732E132DC3B"
},
{
"criteria": "cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8067F8FC-2183-4302-A7EE-29912E68F1A8"
},
{
"criteria": "cpe:2.3:a:apache:nifi:2.0.0:milestone1-rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1C2A606-5B3A-47C7-A94A-9BBA6E4B330F"
},
{
"criteria": "cpe:2.3:a:apache:nifi:2.0.0:milestone2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "200043CB-5676-4005-97B8-C95BCFF3EE0B"
},
{
"criteria": "cpe:2.3:a:apache:nifi:2.0.0:milestone2-rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "73A9B62D-47A5-41B3-8E7C-86DED14A230D"
},
{
"criteria": "cpe:2.3:a:apache:nifi:2.0.0:milestone2-rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "923C9C51-206A-4C12-A60D-3E9DE7808BCD"
},
{
"criteria": "cpe:2.3:a:apache:nifi:2.0.0:milestone2-rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "98CF1F86-BE1E-410E-A425-873081B9B353"
},
{
"criteria": "cpe:2.3:a:apache:nifi:2.0.0:milestone2-rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "34AD9B07-0C66-487A-9D32-A75C99852EE0"
},
{
"criteria": "cpe:2.3:a:apache:nifi:2.0.0:milestone3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1DE8050C-59BA-4789-B211-7AC0D0E696BE"
},
{
"criteria": "cpe:2.3:a:apache:nifi:2.0.0:milestone3-rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "665BBA63-AF45-4B9F-BA0E-6C900E675270"
},
{
"criteria": "cpe:2.3:a:apache:nifi:2.0.0:milestone4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8128158-569B-4FA7-A3CF-AC330B4EED92"
},
{
"criteria": "cpe:2.3:a:apache:nifi:2.0.0:milestone4-rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2F42066D-7304-4C61-9B55-9A3990CDB840"
}
],
"operator": "OR"
}
]
}
]