What is CVE-2024-52067?

CVE-2024-52067 is a medium-severity vulnerability in Apache Nifi, classified under Insertion of Sensitive Information into Log File. CVSS score: 4.9/10. Published 2024-11-21.

How severe is CVE-2024-52067?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Information disclosure in Apache Nifi

CVE-2024-52067

Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causing the application to write Parameter names and values to the application log. Parameter Context values may contain sensitive information depending on application flow configuration. Deployments of Apache NiFi with the default Logback configuration do not log Parameter Context values. Upgrading to Apache NiFi 2.0.0 or 1.28.1 is the recommendation mitigation, eliminating Parameter value logging from the flow synchronization process regardless of the Logback configuration.

EPSS: 0.007 (50.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

Affected products

Apache Nifi — versions 2.0.0
Apache Software Foundation Nifi — versions 1.16.0, 2.0.0-M1

Weakness classification (CWE)

CWE-532 — Insertion of Sensitive Information into Log File

References

security@apache.org (vendor-advisory, Mailing List)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List)

Frequently asked questions

What is CVE-2024-52067?: CVE-2024-52067 is a medium-severity vulnerability in Apache Nifi, classified under Insertion of Sensitive Information into Log File. CVSS score: 4.9/10. Published 2024-11-21.
How severe is CVE-2024-52067?: Medium severity. CVSS v3 base score is 4.9 out of 10.