What is CVE-2025-27017?

CVE-2025-27017 is a medium-severity vulnerability in Apache Nifi, classified under Insertion of Sensitive Information into Externally-Accessible File or Directory. CVSS score: 6.5/10. Published 2025-03-12.

How severe is CVE-2025-27017?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Information disclosure in Apache Nifi

CVE-2025-27017

Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance e…

EPSS: 0.011 (62.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Apache Nifi
Apache Software Foundation Nifi — versions 1.13.0

Weakness classification (CWE)

CWE-538 — Insertion of Sensitive Information into Externally-Accessible File or Directory

References

security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2025-27017?: CVE-2025-27017 is a medium-severity vulnerability in Apache Nifi, classified under Insertion of Sensitive Information into Externally-Accessible File or Directory. CVSS score: 6.5/10. Published 2025-03-12.
How severe is CVE-2025-27017?: Medium severity. CVSS v3 base score is 6.5 out of 10.