CVE-2020-1928 Apache NiFi Insertion of Sensitive Information into Log File
Apache NiFi logs sensitive parameter values, allowing attackers with log access to read confidential data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-1928?
CVE-2020-1928 is a medium-severity vulnerability in Apache Nifi, published on 28 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.
Weakness: CWE-532
Which versions are affected by CVE-2020-1928?
3 open source packages ship an affected version, including org.apache.nifi:nifi-parameter and nifi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.nifi:nifi-parameter Maven | From 1.10.0 | 1.11.0 |
org.apache.nifi:nifi-parameter Maven | From 1.10.0 | 1.11.0 |
nifi Bitnami | From 1.10.0 to 1.10.0 | None |
Products include Apache Nifi.
How do I fix CVE-2020-1928?
Upgrade org.apache.nifi:nifi-parameter to 1.11.0 or later.
Is CVE-2020-1928 being exploited?
There is no known exploitation of CVE-2020-1928 in the wild and no public exploit code.
Other vulnerabilities in Apache Nifi
- CVE-2018-1309 Improper Restriction of XML External Entity Reference in Apache NiFi
- CVE-2017-15697 Apache NiFi XSS issue in context path handling
- CVE-2017-5636 Injection in Apache NiFi
- CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
- CVE-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources
Sources
Also known as BIT-nifi-2020-1928, GHSA-w4fj-ccr6-7pcp.