Threats Tagged 'ghsa-8c35-m833-7pmh'

Apache NiFi versions 2.9.0 through 2.11.0 have a missing authorization vulnerability in the Connector configuration update and verification REST API methods. These methods do not properly enforce authorization checks on Assets and Secrets referenced in the configuration, allowing authenticated users with write privileges on a Connector to apply Secret values from Parameter Providers they are not authorized to read. Additionally, Asset identifiers are accepted without verifying ownership by the Connector. This issue is mitigated by upgrading to Apache NiFi 2.12.0, which enforces read access checks on Parameter Providers and verifies Asset ownership during configuration updates.