Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB compo

APACHE

12-03-2025 23:47

CVE-2025-27017 Vulnerabilidad documentada

6.9 MEDIUM

Tags

#apache

#nifi

#mongodb

#mongo

#form

#db

#/mongo(.*)db/iU

#mongo db

#pass

#password

#access

Descripción

Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in provenance events that components generate during processing. An authorized user read access of those processors may see credentials information. Upgrading Apache 2.3.0 is recommended mitigation, which removes from event records.

https://lists.apache.org/thread/d4n5474jkhp82dvnht13pjtlfx7bhn5q

http://www.openwall.com/lists/oss-security/2025/03/11/1

Referencia

Link externo

Ver detalles

Fuente

https://nvd.nist.gov/vuln/detail/CVE-2025-27017

Resultados similares

Coincidentes en almenos en 50% de los tags

16-03-2026 CVE-2016-20026
ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server tha...
Ver información

13-03-2026 CVE-2025-66249
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in...
Ver información