Information disclosure in Apache Nifi - CVE-2025-27017
Published: March 27, 2025
Vulnerability identifier: #VU106091
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2025-27017
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to the application includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. A remote user with read access to the provenance events can obtain MongoDB credentials.
Affected software
Apache Nifi
How to mitigate CVE-2025-27017
Install updates from vendor's website.
Apache Nifi - update to 2.3.0