CVE-2020-9491

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327

Affected software

Vendor	Product	Versions
n/a	Apache NiFi	Apache NiFi 1.2.0 to 1.11.4

References

Timeline

Published: Oct 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-94928.8In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to CVE-2020-94939.8A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.CVE-2020-94947.5Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can c CVE-2020-94955.3Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the conne CVE-2020-94966.1XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03 CVE-2020-94974.4Apache Guacamole 1.1.0 and older do not properly validate datareceived from RDP servers via static virtual channels. If a userconnects to a CVE-2020-94986.7Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnec CVE-2020-94997.2Some Dahua products have buffer overflow vulnerabilities. After the successful login of the legal account, the attacker sends a specific DDN CVE-2020-95004.9Some products of Dahua have Denial of Service vulnerabilities. After the successful login of the legal account, the attacker sends a specifi CVE-2020-95015.5Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connection CVE-2020-95029.8Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker CVE-2020-95146.5An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress. wrappers.php allows a logged-in user (with the Subs