CVE-2019-12421: Insufficient Session Expiration

November 19, 2019 (updated July 19, 2023)

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user’s client-side token to be used for up to hours after logging out to make API requests to NiFi.

References

github.com/apache/nifi/pull/3362
issues.apache.org/jira/browse/NIFI-6085
nifi.apache.org/security.html
nvd.nist.gov/vuln/detail/CVE-2019-12421

Code Behaviors & Features

Detect and mitigate CVE-2019-12421 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →