-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from ShellUserGroupProvider's handling of group resolution commands. The functions responsible for constructing and executing these commands (e.g., getGroups to build the command, executeCommand to run it) would directly process user-provided arguments without sanitization. The CWE-78 classification confirms this is an OS command injection flaw, and the advisory explicitly states the root cause is improper argument neutralization in group resolution commands. The lack of input sanitization in these command-building/execution functions matches the described vulnerability mechanism.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.nifi.registry:nifi-registry-core | maven | >= 0.6.0, < 1.16.3 | 1.16.3 |
| org.apache.nifi:nifi | maven | >= 1.10.0, < 1.16.3 | 1.16.3 |