CVE-2023-49145: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0-M1 is the recommended mitigation.
References
- www.openwall.com/lists/oss-security/2023/11/27/5
- github.com/advisories/GHSA-68pr-6fjc-wmgm
- github.com/apache/nifi/commit/50efc55df6bb00ea15adcc2459d5cc82d128857f
- github.com/apache/nifi/pull/8060
- issues.apache.org/jira/browse/NIFI-12403
- lists.apache.org/thread/j8rd0qsvgoj0khqck5f49jfbp0fm8r1o
- nifi.apache.org/security.html
- nvd.nist.gov/vuln/detail/CVE-2023-49145
Code Behaviors & Features
Detect and mitigate CVE-2023-49145 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →