CVE-2020-9487 - In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content

Back Back to CVE browser

HIGH

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content

Published Oct 1, 2020

7.5

HIGH

CVSS 3.1

EPSS 3.05%

Description

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens.

Affected products

Vendor n/a Product Apache NiFi Default
n/a
- Version
  Apache NiFi 1.0.0 to 1.11.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Apache NiFi

n/a

Version	Status	Constraints
Apache NiFi 1.0.0 to 1.11.4	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (4)

https://github.com/advisories/GHSA-3pp3-77j6-8ph6
Advisory
https://github.com/apache/nifi/commit/01e42dfb3291c3a3549023edadafd2d8023f3042
https://nifi.apache.org/security#CVE-2020-9487
x_refsource_MISCVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-9487

Link	Providers	Tags
https://github.com/advisories/GHSA-3pp3-77j6-8ph6		Advisory
https://github.com/apache/nifi/commit/01e42dfb3291c3a3549023edadafd2d8023f3042
https://nifi.apache.org/security#CVE-2020-9487		x_refsource_MISCVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-9487