(nifi-site) branch main updated: NIFI-13460 Published CVE-2024-37389

[ex...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

exceptionfactory pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/nifi-site.git


The following commit(s) were added to refs/heads/main by this push:
     new a5a3e8b1 NIFI-13460 Published CVE-2024-37389
a5a3e8b1 is described below

commit a5a3e8b1428b2b6fe1447934e2a1772792261a32
Author: exceptionfactory <ex...@apache.org>
AuthorDate: Sun Jul 7 22:36:14 2024 -0500

    NIFI-13460 Published CVE-2024-37389
---
 content/documentation/security.md | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/content/documentation/security.md b/content/documentation/security.md
index ba9e7ad6..b33a91fe 100644
--- a/content/documentation/security.md
+++ b/content/documentation/security.md
@@ -64,6 +64,25 @@ Severity ratings represent the determination of project members based on an eval
 
 The following announcements include published vulnerabilities that apply directly to Apache NiFi components.
 
+{{< vulnerability
+id="CVE-2024-37389"
+title="Improper Neutralization of Input in Parameter Context Description"
+published="2024-07-08"
+severity="Medium"
+products="Apache NiFi"
+affectedVersions="1.10.0 to 1.26.0 and 2.0.0-M1 to 2.0.0-M3"
+fixedVersion="1.27.0 and 2.0.0-M4"
+jira="NIFI-13374"
+pullRequest="8938"
+reporter="Akbar Kustirama at abay.sh" >}}
+
+Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context
+configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter
+Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the
+authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation.
+
+{{</ vulnerability >}}
+
 {{< vulnerability
 id="CVE-2023-49145"
 title="Improper Neutralization of Input in Advanced User Interface for Jolt"