GHSA-3pp3-77j6-8ph6
Missing Authentication for Critical Function in Apache NiFi
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.nifi:nifi | >= 1.0.0, < 1.12.0-RC1 | 1.12.0-RC1 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens.
References
External links from the advisory. They lead to third-party sites.