CVE-2020-9487
Last modified
CVE-2020-9487 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens.. EPSS estimates a 3.01% chance of exploitation in the next 30 days.
Description
In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Nifi | >= 1.0.0, <= 1.11.4 |
References
- https://nifi.apache.org/security#CVE-2020-9487Vendor Advisory
- https://nifi.apache.org/security#CVE-2020-9487Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-9487?
How severe is CVE-2020-9487?
How do I fix CVE-2020-9487?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-9481Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.…7.5
- CVE-2020-9482If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mecha…6.5
- CVE-2020-9483**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking sto…7.5
- CVE-2020-9484When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.…7
- CVE-2020-9485An issue was found in Apache Airflow versions 1.10.10 and be…6.1
- CVE-2020-9486In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless executio…7.5
- CVE-2020-9488Improper validation of certificate with host mismatch in Apa…3.7
- CVE-2020-9489A carefully crafted or corrupt file may trigger a System.exi…5.5
- CVE-2020-9490Apache HTTP Server versions 2.4.20 to 2.4.43. A specially cr…7.5
- CVE-2020-9491In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were pro…7.5
- CVE-2020-9492In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and …8.8
- CVE-2020-9493A deserialization flaw was found in Apache Chainsaw versions…9.8
Are you affected by CVE-2020-9487?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST