Back
CVE-2020-1928
An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for…
Medium5.3EPSS 4.0%
- Published
- Updated
- Reserved
- Assigned by
- apache
Description
An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 4.0% · top 9.5% of all CVEs (6 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.
Weakness
- Information Disclosure
- CWE-532 (opens in a new tab)All about CWE-532 and its CVEs
Affected products
Apache Software Foundation · Apache NiFi
- affected Apache NiFi 1.10.0
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.apache.nifi:nifi-parameterGHSA-w4fj-ccr6-7pcp (opens in a new tab)
References (4)
- https://nifi.apache.org/security.html#CVE-2020-1928 (opens in a new tab)x_refsource_CONFIRMx_transferred
- [tomcat-users] 20200302 Re: AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [tomcat-users] 20200302 AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [tomcat-users] 20200302 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-w4fj-ccr6-7pcp (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2020-1928)Record last updated .