CVE-2020-9486

—

CVSS 3.1

7.5 high

EPSS

4%p89

Published

Oct 1, 2020 (Oct 1, 2020)

Modified

Jun 17, 2026

Description

In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext.

Vendors: apache
Products: nifi
Weakness: CWE-532
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (3.6%)

In the news0 stories

No ingested article mentions this CVE yet.