CVE-2020-9482: 
Java vulnerability analysis and mitigation

Apache NiFi Registry versions 0.1.0 to 0.5.0 contained a security vulnerability where the application bearer token remained valid after user logout completion. This vulnerability was discovered and reported by Andy LoPresto, and was assigned CVE-2020-9482 (NiFi Security).

When using authentication mechanisms other than PKI, the NiFi Registry would only invalidate the authentication token on the client side but not on the server side when a user clicked the Log Out button. This implementation allowed the user's client-side token to remain valid for API requests to NiFi Registry for up to 12 hours after logging out (NiFi Security).

The vulnerability could potentially allow unauthorized access to the NiFi Registry system for up to 12 hours after a user had logged out, as their authentication token remained valid on the server side. This could lead to unauthorized API requests being processed as if they were coming from the logged-out user (NiFi Security).

The vulnerability required an attacker to have access to a valid authentication token from a previously logged-out session. The exploitation window was limited to 12 hours after the user's logout action (NiFi Security).

The vulnerability was fixed in Apache NiFi Registry version 0.6.0. The fix ensures that the server-side authentication token is immediately invalidated when a user clicks the Log Out link. Users running affected versions should upgrade to version 0.6.0 or later (NiFi Security).