Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Unprotected Apache NiFi API interface - Vulnerability Database

Unprotected Apache NiFi API interface

Description

Apache NiFi is a tool that automates the flow of data between systems. A default installation is served over HTTP and does not require authentication, meaning that all connections have administrative privileges.

It's recommended to restrict access Apache NiFi and enable authentication.

Remediation

It's recommended to restrict access Apache NiFi and enable authentication.

References

Metasploit Modules for RCE in Apache NiFi and Kong API Gateway

Related Vulnerabilities

WordPress admin accessible without HTTP authentication Low
Common tags: Insecure Admin Access Configuration
Unprotected Kong Gateway Admin API interface Medium
Common tags: Insecure Admin Access Configuration
Unauthorized Access to a web app installer Medium
Common tags: Insecure Admin Access Configuration
Jupyter Notebook publicly accessible High
Common tags: Insecure Admin Access Configuration
Apache Geronimo default administrative credentials High
Common tags: Insecure Admin Access Configuration

Severity

Medium

Classification

CWE-287
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Insecure Admin Access
Configuration