CVE-2024-56512

Summary

CVE-2024-56512 affects Apache NiFi versions 1.10.0 to 2.0.0, where unchecked authorization occurs during the creation of new Process Groups. The vulnerability allows authenticated users with Process Group creation permissions to access unauthorized Parameter Contexts, Controller Services, and Parameter Providers. This can lead to downloading non-sensitive Parameter values or using unauthorized components. The impact is limited to deployments with component-based authorization policies, and upgrading to Apache NiFi 2.1.0, which includes authorization checks on Process Group creation, is the recommended mitigation.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.