-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.nifi:nifi-web-ui | maven | >= 1.10.0, < 1.28.0 | 1.28.0 |
| org.apache.nifi:nifi-web-ui | maven | >= 2.0.0-M1, < 2.0.0-M4 | 2.0.0-M4 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped parameter descriptions being rendered in tooltips. The GitHub patch shows the fix added nfCommon.escapeHtml() to sanitize parameter.description in the qtip content configuration. The pre-patch code (line 2197) lacked this sanitization, making it vulnerable to XSS via crafted parameter descriptions. The direct correlation between the vulnerability description and the specific code change indicates this was the vulnerable code path.
Ongoing coverage of React2Shell