CVE-2020-9491

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327

Affected software

No affected versions have been published.

Timeline

Published
Oct 1, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-94928.8In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to CVE-2020-94939.8A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.CVE-2020-94947.5Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cCVE-2020-94955.3Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the conneCVE-2020-94966.1XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03CVE-2020-94974.4Apache Guacamole 1.1.0 and older do not properly validate datareceived from RDP servers via static virtual channels. If a userconnects to a CVE-2020-94986.7Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnecCVE-2020-94997.2Some Dahua products have buffer overflow vulnerabilities. After the successful login of the legal account, the attacker sends a specific DDNCVE-2020-95004.9Some products of Dahua have Denial of Service vulnerabilities. After the successful login of the legal account, the attacker sends a specifiCVE-2020-95015.5Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connectionCVE-2020-95029.8Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attackerCVE-2020-95146.5An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress. wrappers.php allows a logged-in user (with the Subs
CVE-2020-9491: High severity, CVSS 7.5 | Vulnix