CVE-2020-1933

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache NiFi	Apache NiFi 1.0.0 to 1.10.0

References

https://nifi.apache.org/security.html#CVE-2020-1933Vendor Advisory
https://nifi.apache.org/security.html#CVE-2020-1933Vendor Advisory

Timeline

Published: Jan 28, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-19345.3In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.CVE-2020-19354.8In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsin CVE-2020-19366.1A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4.CVE-2020-193607.5Local file inclusion in FHEM 6.0 allows in fhem/FileLog_logWrapper file parameter can allow an attacker to include a file, which can lead to CVE-2020-193616.1Reflected XSS in Medintux v2.16.000 CCAM.php by manipulating the mot1 parameter can result in an attacker performing malicious actions to us CVE-2020-193626.1Reflected XSS in Vtiger CRM v7.2.0 in vtigercrm/index.php? through the view parameter can result in an attacker performing malicious actions CVE-2020-193636.5Vtiger CRM v7.2.0 allows an attacker to display hidden files, list directories by using /libraries and /layout directories.CVE-2020-193648.8OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.CVE-2020-19378.8Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database qu CVE-2020-19389.8When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connec CVE-2020-19399.8The Apache NuttX (Incubating) project provides an optional separate "apps" repository which contains various optional components and example CVE-2020-19407.5The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensit