Description
In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache NiFi | 1.0.0, 1.1.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.nifi:nifi | < 1.0.1 | 1.0.1 | GHSA-g2fm-x3cp-mqw9 |
| Maven | org.apache.nifi:nifi | >= 1.1.0, < 1.1.1 | 1.1.1 | GHSA-g2fm-x3cp-mqw9 |