Medium severity · published Nov 21, 2024
CVE-2024-52067
Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log
4.9
CVSS
0.7%
EPSS
No
On KEV
Description
Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causing the application to write Parameter names and values to the application log. Parameter Context values may contain sensitive information depending on application flow configuration. Deployments of Apache NiFi with the default Logback configuration do not log Parameter Context values. Upgrading to Apache NiFi 2.0.0 or 1.28.1 is the recommendation mitigation, eliminating Parameter value logging from the flow synchronization process regardless of the Logback configuration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Apache NiFi · Apache Software Foundation
1.16.0 through 1.28.0; 2.0.0-M1 through 2.0.0-M4 · source: vendor
NI
Nifi · Apache
1.16.0 before 1.28.1; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +11 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52067
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52067
Mailing List
https://lists.apache.org/thread/9rz5rwn2zc7pfjq7ppqldqlc067tlcwd
Mailing List
http://www.openwall.com/lists/oss-security/2024/11/20/2
More from Apache NiFi
9.8
CVE-2026-68979
Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates
9.1
CVE-2026-68980
Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion
8.8
CVE-2026-39816
Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService
8.8
CVE-2025-66524
Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor
7.5
CVE-2026-70469
Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests