CVE-2021-33191 is a critical vulnerability affecting Apache NiFi MiNiFi C++ versions 0.5.0 through 0.9.0. It allows an attacker to execute arbitrary commands with the same privileges as the application binary due to an insecure "agent-update" command within the c2 protocol. This vulnerability has a CVSS score of 9.8 (Critical) with a network attack vector and low attack complexity, enabling full compromise of confidentiality, integrity, and availability. While no active exploitation or public exploit code is currently reported, its critical severity and ease of exploitation warrant immediate patching to version 0.10.0 or later. Community discussion and media coverage for this CVE are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0.5.0, < 0.10.0CPE matchmatch criteria | cpe:2.3:a:apache:nifi_minifi_c\+\+:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.