Threats Tagged 'ghsa-hfp7-cf28-6f6q'

Apache NiFi versions 1.5.0 through 2.11.0 have a missing authorization vulnerability in REST API methods that replace the entire contents of a Process Group. Authenticated users with write access to a Process Group could modify or remove components in descendant Process Groups without proper authorization. This issue affects deployments using component-level authorization policies and is limited by existing checks to stopped components. Upgrading to Apache NiFi 2.12.0 addresses this inconsistency in authorization enforcement.