CVE-2019-10083
Last modified
CVE-2019-10083 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.. EPSS estimates a 2.75% chance of exploitation in the next 30 days.
Description
When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Nifi | >= 1.3.0, <= 1.9.2 |
References
- https://nifi.apache.org/security.html#CVE-2019-10083Vendor Advisory
- https://nifi.apache.org/security.html#CVE-2019-10083Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-10083?
How severe is CVE-2019-10083?
How do I fix CVE-2019-10083?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-10078A carefully crafted plugin link invocation could trigger an …
- CVE-2019-10079Apache Traffic Server is vulnerable to HTTP/2 setting flood …7.5
- CVE-2019-1008A security feature bypass vulnerability exists in Dynamics O…
- CVE-2019-10080The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 all…6.5
- CVE-2019-10081HTTP/2 (2.4.20 through 2.4.39) very early pushes, for exampl…
- CVE-2019-10082In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network in…9.1
- CVE-2019-10084In Apache Impala 2.7.0 to 3.2.0, an authenticated user with …7.5
- CVE-2019-10085In Apache Allura prior to 1.11.0, a vulnerability exists for…
- CVE-2019-10086In Apache Commons Beanutils 1.9.2, a special BeanIntrospecto…7.3
- CVE-2019-10087On Apache JSPWiki, up to version 2.11.0.M4, a carefully craf…6.1
- CVE-2019-10088A carefully crafted or corrupt zip file can cause an OOM in …
- CVE-2019-10089On Apache JSPWiki, up to version 2.11.0.M4, a carefully craf…6.1
Are you affected by CVE-2019-10083?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST