CVE-2020-9482 Insufficient Session Expiration in Apache NiFi Registry
Attackers can reuse client-side tokens for up to 12 hours after logout if non-PKI authentication is used, bypassing session invalidation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-9482?
CVE-2020-9482 is a medium-severity vulnerability in Apache NiFi Registry, published on 28 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi Registry.
Weakness: CWE-613
Which versions are affected by CVE-2020-9482?
2 open source packages ship an affected version, including org.apache.nifi.registry:nifi-registry-web-api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.nifi.registry:nifi-registry-web-api Maven | From 0.1.0 | 0.7.0 |
org.apache.nifi.registry:nifi-registry-web-api Maven | From 0.1.0 | 0.7.0 |
Products include Apache Nifi Registry.
How do I fix CVE-2020-9482?
Upgrade org.apache.nifi.registry:nifi-registry-web-api to 0.7.0 or later.
Is CVE-2020-9482 being exploited?
There is no known exploitation of CVE-2020-9482 in the wild and no public exploit code.
Sources
Also known as GHSA-rcwj-2hj2-vmjj.