CVE-2020-9491
Last modified
CVE-2020-9491 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.. EPSS estimates a 2.84% chance of exploitation in the next 30 days.
Description
In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Nifi | >= 1.0.0, <= 1.11.4 |
References
- https://nifi.apache.org/security#CVE-2020-9491Vendor Advisory
- https://nifi.apache.org/security#CVE-2020-9491Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-9491?
How severe is CVE-2020-9491?
How do I fix CVE-2020-9491?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-9485An issue was found in Apache Airflow versions 1.10.10 and be…6.1
- CVE-2020-9486In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless executio…7.5
- CVE-2020-9487In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one…7.5
- CVE-2020-9488Improper validation of certificate with host mismatch in Apa…3.7
- CVE-2020-9489A carefully crafted or corrupt file may trigger a System.exi…5.5
- CVE-2020-9490Apache HTTP Server versions 2.4.20 to 2.4.43. A specially cr…7.5
- CVE-2020-9492In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and …8.8
- CVE-2020-9493A deserialization flaw was found in Apache Chainsaw versions…9.8
- CVE-2020-9494Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8…7.5
- CVE-2020-9495Apache Archiva login service before 2.2.5 is vulnerable to L…5.3
- CVE-2020-9496XML-RPC request are vulnerable to unsafe deserialization and…6.1
- CVE-2020-9497Apache Guacamole 1.1.0 and older do not properly validate da…4.4
Are you affected by CVE-2020-9491?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST