CVE-2020-9487
published 2020-10-01CVE-2020-9487: In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
3.05%
86.1th percentile
In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | nifi | — | — |
| apache | nifi | 1.0.0 – 1.11.4 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_apache7.5
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Missing Authentication for Critical Function in Apache NiFi
ghsa·2022-01-06
CVE-2020-9487 [HIGH] CWE-306 Missing Authentication for Critical Function in Apache NiFi
Missing Authentication for Critical Function in Apache NiFi
In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens.
OSV
Missing Authentication for Critical Function in Apache NiFi
osv·2022-01-06
CVE-2020-9487 [HIGH] Missing Authentication for Critical Function in Apache NiFi
Missing Authentication for Critical Function in Apache NiFi
In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens.
Apache
Apache nifi: CVE-2020-9487
vendor_apache·CVSS 7.5
CVE-2020-9487 Apache nifi: CVE-2020-9487
Apache nifi: CVE-2020-9487
Title: Potential Denial of Service with Token Authentication Requests Published: 2020-08-18 Severity: Medium Products: Apache NiFi Affected Versions: 1.0.0 to 1.11.4 Fixed Versions: 1.12.0 Reporter: Dennis Detering, IT Security Consultant at Spike Reply References CVE Record: CVE-2020-9487 NVD Record: CVE-2020-9487 Apache Jira Issue: NIFI-7385 GitHub Pull Request: 4271 The NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens. NiFi 1.12.0 disabled anonymous authentication, implemented a multi-index
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-10-01
Published