-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.nifi:nifi-web-ui | maven | >= 1.10.0, < 1.27.0 | 1.27.0 |
| org.apache.nifi:nifi-web-ui | maven | >= 2.0.0-M1, < 2.0.0-M4 | 2.0.0-M4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unescaped HTML output in multiple UI components handling user-controlled descriptions. The patch adds nfCommon.escapeHtml() to these specific locations where parameter context/registry descriptions are rendered. The affected code paths construct UI options that display user-provided descriptions in tooltips and configuration dialogs without proper sanitization, enabling XSS when malicious content is stored in the description field.
A Semantic Attack on Google Gemini - Read the Latest Research