{"action":"Upgrade org.apache.nifi:nifi-web-ui to 1.28.0 (1.x) or 2.0.0-M4 (2.x) or later.","affected":[{"fixed":"1.28.0","introduced":"1.10.0"},{"fixed":"2.0.0-M4","introduced":"2.0.0-M1"}],"component":"org.apache.nifi:nifi-web-ui","cve_ids":["CVE-2024-45477"],"ecosystem":"Maven","epss":0.0075,"exploited":false,"fixed_versions":["1.28.0","2.0.0-M4"],"ghsa_id":"GHSA-7mqj-xgf8-p59v","id":"tcs_01M5N8JQ8J0CM7PB6K06HPF5FY","modified_at":"2026-09-04T11:55:23.371201366Z","published_at":"2024-10-29T09:30:51Z","references":["https://osv.dev/vulnerability/GHSA-7mqj-xgf8-p59v","https://nvd.nist.gov/vuln/detail/CVE-2024-45477","https://github.com/apache/nifi/pull/9195","https://github.com/apache/nifi/commit/153c87a7daaeebea9b119066285b840ea4056e09","https://github.com/apache/nifi","https://github.com/apache/nifi/blob/rel/nifi-1.27.0/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/canvas/nf-parameter-contexts.js#L2197","https://issues.apache.org/jira/browse/NIFI-13675","https://lists.apache.org/thread/shdv0tw9hggj7tx9pl7g93mgok2lwbj9","https://nifi.apache.org/documentation/security/#CVE-2024-45477"],"severity":{"label":"medium","score":4.6},"sources":[{"source":"osv","source_id":"GHSA-7mqj-xgf8-p59v","url":"https://osv.dev/vulnerability/GHSA-7mqj-xgf8-p59v"}],"summary":"Apache NiFi Cross-site Scripting vulnerability"}