CVE-2024-37389 json
Apache NiFi: Improper Neutralization of Input in Parameter Context Description
published 2024-07-08 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-2356 , GHSA-h658-qqv9-qwv8
- cvss
- 4.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 24.0%
- EPSS 24.0% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation.
Patch / fix
- maven org.apache.nifi:nifi-web-ui 1.27.0, 2.0.0-M4
- org.apache.nifi nifi-web-ui 1.27.0, 2.0.0-M4
- github.com/apache/nifi@1ea0bc1 commit
- github.com/apache/nifi#8938 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
24.03% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.nifi:nifi-web-ui | >=1.10.0, <1.27.0 >=2.0.0-M1, <2.0.0-M4 |
1.27.0 2.0.0-M4 |
Affected products
- Apache Software Foundation Apache NiFi
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/apache/nifi/pull/8938
web
-
github.com
/apache/nifi/commit/1ea0bc1f7fa90ecff0ceb8b0c91a9aebeb05893b
web
-
lists.apache.org
/thread/yso9fr0wtff53nk046h1o83hdyb1lrxh
vendor-advisory, web, mailing-list
- openwall.com /lists/oss-security/2024/07/08/1
-
nvd.nist.gov
/vuln/detail/CVE-2024-37389
advisory
-
github.com
/apache/nifi
package
-
issues.apache.org
/jira/browse/NIFI-13374
web
Sources
- CVE List CVE-2024-37389
- GitHub Advisory GHSA-h658-qqv9-qwv8
- NVD CVE-2024-37389
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.