Detections
Analytics

SCA: security update for org.apache.nifi:nifi-web-api (GHSA-mpj7-7mg7-x95j)

low Tenable Cloud Security Plugin ID 417060

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts,
 referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups.
 Creating a new Process Group can include binding to a Parameter Context, but in cases where the Process
 Group did not reference any Parameter values, the framework did not check user authorization for the bound
 Parameter Context. Missing authorization for a bound Parameter Context enabled clients to download non-
 sensitive Parameter values after creating the Process Group. Creating a new Process Group can also include
 referencing existing Controller Services or Parameter Providers. The framework did not check user
 authorization for referenced Controller Services or Parameter Providers, enabling clients to create
 Process Groups and use these components that were otherwise unauthorized. This vulnerability is limited in
 scope to authenticated users authorized to create Process Groups. The scope is further limited to
 deployments with component-based authorization policies. Upgrading to Apache NiFi 2.1.0 is the recommended
 mitigation, which includes authorization checking for Parameter and Controller Service references on
 Process Group creation. (CVE-2024-56512)

See Also

https://github.com/advisories/GHSA-mpj7-7mg7-x95j

Plugin Details

Severity: Low

ID: 417060

Version: Revision 1.18

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.1

Percentile: 7.71

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2024-56512

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Low

Base Score: 2.1

Threat Score: 0.5

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/28/2024

Vulnerability Publication Date: 12/28/2024

Reference Information

CVE: CVE-2024-56512