CVE-2024-56512

CVE-2024-56512 is a medium-severity vulnerability affecting Apache NiFi versions 1.10.0 through 2.0.0. It involves missing fine-grained authorization checks when authenticated users create new Process Groups, allowing them to access unauthorized Parameter Contexts, Controller Services, or Parameter Providers. This could lead to information disclosure of non-sensitive parameter values or the use of components they are not authorized for. While there is no evidence of active exploitation, a Nuclei template exists for information disclosure, and the vulnerability has a high FAUCET Risk Score of 96/100, indicating potential for exploitation.