GHSA-68pr-6fjc-wmgm

Improper Neutralization of Input in Advanced User Interface for Jolt

Source: GitHub Advisory Database (reviewed) High CVE-2023-49145

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.nifi:nifi-jolt-transform-json-ui	< 1.24.0	1.24.0

Details

As written in the advisory (Markdown source, shown as plain text).

Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0-M1 is the recommended mitigation.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-49145 advisory
https://github.com/apache/nifi/pull/8060 web
https://github.com/apache/nifi/commit/50efc55df6bb00ea15adcc2459d5cc82d128857f web
https://github.com/apache/nifi package
https://issues.apache.org/jira/browse/NIFI-12403 web
https://lists.apache.org/thread/j8rd0qsvgoj0khqck5f49jfbp0fm8r1o web
https://nifi.apache.org/security.html#CVE-2023-49145 web
http://www.openwall.com/lists/oss-security/2023/11/27/5 web