CVE-2024-52067 json
Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log
published last yr. modified 4mo ago also EUVD-2024-45989 , GHSA-v3vc-6qcv-4vrx
- cvss
- 4.9
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causing the application to write Parameter names and values to the application log. Parameter Context values may contain sensitive information depending on application flow configuration. Deployments of Apache NiFi with the default Logback configuration do not log Parameter Context values. Upgrading to Apache NiFi 2.0.0 or 1.28.1 is the recommendation mitigation, eliminating Parameter value logging from the flow synchronization process regardless of the Logback configuration.
Patch / fix
- maven org.apache.nifi:nifi-framework-core 1.28.1, 2.0.0
- org.apache.nifi nifi-framework-core 1.28.1, 2.0.0
- github.com/apache/nifi@5aed878 commit
- github.com/apache/nifi@c110836 commit
Is CVE-2024-52067 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.73% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/AU:Y/R:U/V:D/RE:L/U:Green |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:L/U:Green |
| NVD | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.nifi:nifi-framework-core | >=1.16.0, <1.28.1 >=2.0.0-M1, <2.0.0 |
1.28.1 2.0.0 |
Affected products
- Apache Software Foundation Apache NiFi
Classification
- Weakness
-
- CWE-532 Insertion of Sensitive Information into Log File
References
-
github.com
/apache/nifi/commit/5aed878c5d2a193cd2039c2e997bc3025046bc41
web
-
github.com
/apache/nifi/commit/c1108365949268631526d5016b1a163a82f8e9df
web
-
lists.apache.org
/thread/9rz5rwn2zc7pfjq7ppqldqlc067tlcwd
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2024/11/20/2
web, mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2024-52067
advisory
-
github.com
/apache/nifi
package
-
issues.apache.org
/jira/browse/NIFI-13971
web
Sources
- CVE List CVE-2024-52067
- GitHub Advisory GHSA-v3vc-6qcv-4vrx
- NVD CVE-2024-52067
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.