maven package report

Is org.apache.nifi:nifi-web-security safe?

1 known vulnerability, worst severity HIGH.

cvss
7.5

how bad it is if exploited, out of 10

epss
1.8%

chance of exploitation in the next 30 days

xyz score
3.4

CyberXYZ composite, out of 10

fig. 01 — GHSA-fmqw-vqh5-cwq9, the advisory selected below

// advisories

GHSA-fmqw-vqh5-cwq9

HIGHCVE-2019-12421

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi.

Affected
>= 1.3.0, < 1.10.0
Fixed in
1.10.0
Weakness
CWE-613
Published
2019-12-02
Source
github

GHSANVDMITREreferencereferencereferencereference

// dependencies

0 direct

Sign in for dependency paths and remediation

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.

Checked 2026-09-22 at 00:46 UTC. The most recent advisory here was published 2019-12-02. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.
Is org.apache.nifi:nifi-web-security safe? maven package security report | CyberXYZ