What’s Vulnerable › Vulnerabilities

CVE-2019-10083

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-19 · updated 2026-06-17
• Weakness: CWE-200

Description

When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.

Affected products

• Apache Software Foundation Apache NiFi: from 1.3.0 through 1.9.2

References

• https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
• https://nifi.apache.org/security.html#CVE-2019-10083
• https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
• https://nifi.apache.org/security.html#CVE-2019-10083

Get alerted when CVE-2019-10083 or the next vulnerability affects your stack