What is GHSA-g2fm-x3cp-mqw9?

GHSA-g2fm-x3cp-mqw9 is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site Scripting in Apache NiFi

Which CVE IDs does GHSA-g2fm-x3cp-mqw9 cover?

GHSA-g2fm-x3cp-mqw9 covers the following CVE IDs: CVE-2016-8748. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g2fm-x3cp-mqw9?

GHSA-g2fm-x3cp-mqw9 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-g2fm-x3cp-mqw9?

GHSA-g2fm-x3cp-mqw9 affects 2 products, including: maven/org.apache.nifi:nifi:\u003c 1.0.1; maven/org.apache.nifi:nifi:\u003e= 1.1.0, \u003c 1.1.1.

GHSA-g2fm-x3cp-mqw9MediumCVSS 5.4

Cross-site Scripting in Apache NiFi

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

January 30, 2023

🔗 CVE IDs covered (1)

CVE-2016-8748 →

📋 Description

In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.

🎯 Affected products2

maven/org.apache.nifi:nifi:< 1.0.1
maven/org.apache.nifi:nifi:>= 1.1.0, < 1.1.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2016-8748
https://nifi.apache.org/security.html#CVE-2016-8748
http://www.securityfocus.com/bid/95621
https://github.com/advisories/GHSA-g2fm-x3cp-mqw9