{"action":"Upgrade org.apache.nifi:nifi-web-ui to 1.27.0 (1.x) or 2.0.0-M4 (2.x) or later.","affected":[{"fixed":"1.27.0","introduced":"1.10.0"},{"fixed":"2.0.0-M4","introduced":"2.0.0-M1"}],"component":"org.apache.nifi:nifi-web-ui","cve_ids":["CVE-2024-37389"],"ecosystem":"Maven","epss":0.24031,"exploited":false,"fixed_versions":["1.27.0","2.0.0-M4"],"ghsa_id":"GHSA-h658-qqv9-qwv8","id":"tcs_01M5N8ZTHS3G8MR3C19RVYXSCD","modified_at":"2026-09-10T03:50:16.825746587Z","published_at":"2024-07-08T09:32:22Z","references":["https://osv.dev/vulnerability/GHSA-h658-qqv9-qwv8","https://nvd.nist.gov/vuln/detail/CVE-2024-37389","https://github.com/apache/nifi/pull/8938","https://github.com/apache/nifi/commit/1ea0bc1f7fa90ecff0ceb8b0c91a9aebeb05893b","https://github.com/apache/nifi","https://issues.apache.org/jira/browse/NIFI-13374","https://lists.apache.org/thread/yso9fr0wtff53nk046h1o83hdyb1lrxh"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-h658-qqv9-qwv8","url":"https://osv.dev/vulnerability/GHSA-h658-qqv9-qwv8"}],"summary":"Apache NiFi vulnerable to Cross-site Scripting"}