Description

Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

Remediation

References

https://nifi.apache.org/security.html#CVE-2017-15703

Related Vulnerabilities

CVE-2018-1260 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth2

CVE-2022-25205 Vulnerability in maven package org.jenkins-ci.plugins:dbcharts

CVE-2016-1202 Vulnerability in maven package org.webjars.npm:electron

CVE-2011-4838 Vulnerability in maven package org.jruby:jruby-stdlib

CVE-2022-36886 Vulnerability in maven package org.jenkins-ci.plugins:external-monitor-job

Severity

Medium

Classification

CWE-502 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Tags

Vendor Advisory