-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.nifi:nifi-mongodb-services | maven | >= 1.13.0, < 2.3.0 | 2.3.0 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from credentials being included in provenance events. The commit diff shows the removal of the getURI method, which previously manually injected credentials into the MongoDB connection URI using URL encoding. This URI was likely logged in provenance events. The patched version avoids embedding credentials in the URI by using MongoCredential separately, and the test update verifies the transit URI no longer contains credentials. The getURI() function's role in constructing the credential-containing URI directly matches the vulnerability's root cause.
Ongoing coverage of React2Shell