CVE-2024-52067 Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log
An authorized administrator can enable debug logging to expose sensitive Parameter Context values in application logs, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-52067?
CVE-2024-52067 is a medium-severity vulnerability in Apache Nifi, published on 21 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causing the application to write Parameter names and values to the application log. Parameter Context values may contain sensitive information depending on application flow configuration. Deployments of Apache NiFi with the default Logback configuration do not log Parameter Context values. Upgrading to Apache NiFi 2.0.0 or 1.28.1 is the recommendation mitigation, eliminating Parameter value logging from the flow synchronization process regardless of the Logback configuration.
Weakness: CWE-532
Which versions are affected by CVE-2024-52067?
4 open source packages ship an affected version, including org.apache.nifi:nifi-framework-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.nifi:nifi-framework-core Maven | From 1.16.0 | 1.28.1 |
org.apache.nifi:nifi-framework-core Maven | From 1.16.0 | 1.28.1 |
org.apache.nifi:nifi-framework-core Maven | From 2.0.0-M1 | 2.0.0 |
org.apache.nifi:nifi-framework-core Maven | From 2.0.0-M1 | 2.0.0 |
Products include Apache Nifi.
How do I fix CVE-2024-52067?
Upgrade org.apache.nifi:nifi-framework-core to a fixed version for your release line: 1.28.1 or 2.0.0.
Is CVE-2024-52067 being exploited?
There is no known exploitation of CVE-2024-52067 in the wild and no public exploit code.
Other vulnerabilities in Apache Nifi
- CVE-2018-1309 Improper Restriction of XML External Entity Reference in Apache NiFi
- CVE-2017-15697 Apache NiFi XSS issue in context path handling
- CVE-2017-5636 Injection in Apache NiFi
- CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
- CVE-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources
Sources
Also known as GHSA-v3vc-6qcv-4vrx.