CVE-2023-49145: 
Java vulnerability analysis and mitigation

Apache NiFi versions 0.7.0 through 1.23.2 contain a DOM-based cross-site scripting vulnerability in the JoltTransformJSON Processor's advanced configuration user interface. The vulnerability was discovered on November 22, 2023, and was assigned CVE-2023-49145. The issue affects the JoltTransformJSON Processor component, which is part of Apache NiFi's data transformation capabilities (Apache Security, NVD).

The vulnerability is classified as a DOM-based cross-site scripting issue (CWE-79). It received a CVSS v3.1 base score of 7.9 (HIGH) from Apache Software Foundation and 5.4 (MEDIUM) from NIST NVD. The vulnerability exists in the advanced configuration user interface of the JoltTransformJSON Processor, where input is not properly neutralized before being processed by the DOM (NVD).

If successfully exploited, the vulnerability allows arbitrary JavaScript code execution within the session context of an authenticated user. This occurs when an authorized user, who has permissions to configure a JoltTransformJSON Processor, visits a specially crafted URL (OSS Security).

The recommended mitigation is to upgrade to Apache NiFi version 1.24.0 or 2.0.0-M1, which contains fixes for this vulnerability. No alternative workarounds have been published (Apache Security).