Threats Tagged 'ghsa-5rjq-rw3w-qr4c'

Apache NiFi 2.11.0 contains a missing authorization vulnerability in its REST API methods for migrating version-controlled Process Groups into Connectors. The vulnerability allows authenticated users with read or write access to a Connector to access or migrate Process Groups without proper authorization checks on those Process Groups. This can lead to unauthorized enumeration of Process Group details or migration of Process Groups without write access. The vulnerability is mitigated in Apache NiFi 2.12.0 by enforcing authorization checks on the source Process Groups during migration requests.