What’s Vulnerable › Vulnerabilities

CVE-2020-1942

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-02-11 · updated 2026-06-17
• Weakness: CWE-532

Description

In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was printed, potentially containing sensitive values in plaintext.

Affected products

• Apache Software Foundation Apache NiFi: from 0.0.1 through 1.11.0

References

• https://nifi.apache.org/security.html#CVE-2020-1942
• https://nifi.apache.org/security.html#CVE-2020-1942

Get alerted when CVE-2020-1942 or the next vulnerability affects your stack