ID:11053 - Exploit for Missing Authorization in Apache Nifi - CVE-2024-56512

Link to public exploit:

Vulnerability description

The vulnerability allows a remote user to bypass certain security restrictions.

The vulnerability exists due to missing authorization checks for parameters context when creating process groups. A remote authenticated user with privileges to create process groups can bypass authorization checks by not referencing parameter values and gain access to sensitive information.

Remediation