This is an automated email from the ASF dual-hosted git repository. exceptionfactory pushed a commit to branch main-staging in repository https://gitbox.apache.org/repos/asf/nifi-site.git
commit eb214697631a4058449adce89fc8edc5f3028c79 Author: exceptionfactory <[email protected]> AuthorDate: Sun Jul 7 22:36:14 2024 -0500 NIFI-13460 Published CVE-2024-37389 (cherry picked from commit a5a3e8b1428b2b6fe1447934e2a1772792261a32) --- content/documentation/security.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/content/documentation/security.md b/content/documentation/security.md index ba9e7ad6..b33a91fe 100644 --- a/content/documentation/security.md +++ b/content/documentation/security.md @@ -64,6 +64,25 @@ Severity ratings represent the determination of project members based on an eval The following announcements include published vulnerabilities that apply directly to Apache NiFi components. +{{< vulnerability +id="CVE-2024-37389" +title="Improper Neutralization of Input in Parameter Context Description" +published="2024-07-08" +severity="Medium" +products="Apache NiFi" +affectedVersions="1.10.0 to 1.26.0 and 2.0.0-M1 to 2.0.0-M3" +fixedVersion="1.27.0 and 2.0.0-M4" +jira="NIFI-13374" +pullRequest="8938" +reporter="Akbar Kustirama at abay.sh" >}} + +Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context +configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter +Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the +authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation. + +{{</ vulnerability >}} + {{< vulnerability id="CVE-2023-49145" title="Improper Neutralization of Input in Advanced User Interface for Jolt"
