{"id":"CVE-2020-1928","aliases":["BIT-nifi-2020-1928","EUVD-2022-0716","GHSA-w4fj-ccr6-7pcp"],"status":"published","title":"Apache NiFi Insertion of Sensitive Information into Log File","description":"An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03959,"percentile":0.90516,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-532"],"published":"2020-01-28T00:28:08Z","modified":"2026-10-24T10:30:53Z","fixes":[{"ecosystem":"Maven","package":"org.apache.nifi:nifi-parameter","fixed_in":["1.11.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.nifi:nifi-parameter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"last_affected":"1.10.0"},{"fixed":"1.11.0"}]}],"versions":["1.10.0"]},{"source":"osv","ecosystem":"Bitnami","package":"nifi","ranges":[{"type":"SEMVER","events":[{"introduced":"1.10.0"},{"last_affected":"1.10.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.nifi:nifi-parameter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.11.0"}]}],"versions":["1.10.0"]}],"products":[{"vendor":"apache","product":"nifi"},{"vendor":"apache software foundation","product":"apache nifi"}],"references":[{"url":"https://nifi.apache.org/security.html#CVE-2020-1928","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1928","tags":["web","advisory"]},{"url":"https://github.com/apache/nifi/commit/42cb6e84898e66672878f61f99543d6af3c0a567","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e@%3Cusers.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1@%3Cusers.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b@%3Cusers.tomcat.apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/nifi/pull/3935","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w4fj-ccr6-7pcp"},{"url":"https://github.com/apache/nifi","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-1928","description":"An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.","status":"published","published":"2020-01-28T00:28:08Z","modified":"2024-08-04T06:54:00.379Z","updated_at":"2026-11-02T14:35:56.638833Z"}],"euvd":[{"id":"EUVD-2022-0716","description":"An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.","status":"published","published":"2020-01-28T00:28:08Z","modified":"2024-08-04T06:54:00Z","updated_at":"2026-11-03T03:08:10.95725Z"}],"ghsa":[{"id":"GHSA-w4fj-ccr6-7pcp","title":"Apache NiFi Insertion of Sensitive Information into Log File","description":"An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.","status":"published","published":"2022-01-06T20:40:56Z","modified":"2023-09-25T11:29:41Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-532"],"updated_at":"2026-11-02T14:37:06.234371Z"}],"nvd":[{"id":"CVE-2020-1928","description":"An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.","status":"published","published":"2020-01-28T01:15:12.41Z","modified":"2026-06-17T03:02:37.73Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:05:53.837808Z"}],"osv":[{"id":"CVE-2020-1928","description":"An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.","status":"published","published":"2020-01-28T01:15:12.41Z","modified":"2026-10-24T10:30:53.710744433Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:15.212689Z"},{"id":"GHSA-w4fj-ccr6-7pcp","title":"Apache NiFi Insertion of Sensitive Information into Log File","description":"An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.","status":"published","published":"2022-01-06T20:40:56Z","modified":"2025-09-15T07:42:09.959845Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-532"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"BIT-nifi-2020-1928","description":"An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.","status":"published","published":"2025-09-12T11:46:36.422Z","modified":"2026-09-08T08:48:17.296915139Z","updated_at":"2026-11-02T15:28:34.007508Z"}]}}