CVE-2020-9487

Description

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens.

Risk Information

Base Score

7.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

0.633

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2020-9491,CVE-2020-9487,CVE-2020-13940 are fixed in Apache-nifi-api 1.12.0	Windows
Vulnerabilities CVE-2020-9491,CVE-2020-9487,CVE-2020-13940 are fixed in Apache-Nifi-api for Linux 1.12.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234