cve.bz

CVE-2024-37389

5.4 mediumEPSS 24%

Medium (5.4) in apache nifi. EPSS 24% chance of exploitation in the next 30 days. Fixed in org.apache.nifi:nifi-web-ui 1.27.0, 2.0.0-M4.

Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation.

Severity

CVSS 3.1

5.4 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
24% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-h658-qqv9-qwv8Mavenorg.apache.nifi:nifi-web-ui>=1.10.0 <1.27.01.27.0
GHSA-h658-qqv9-qwv8Mavenorg.apache.nifi:nifi-web-ui>=2.0.0-M1 <2.0.0-M42.0.0-M4

References

Check your stackJSON