Description

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node.

Remediation

References

http://www.securityfocus.com/bid/96731

https://nifi.apache.org/security.html#CVE-2017-5636

Related Vulnerabilities

CVE-2017-16110 Vulnerability in npm package weather.swlyons

CVE-2022-23510 Vulnerability in npm package @cubejs-backend/api-gateway

CVE-2019-16555 Vulnerability in maven package com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

CVE-2020-11994 Vulnerability in maven package org.apache.camel:camel-robotframework

CVE-2019-10279 Vulnerability in maven package org.jenkins-ci.plugins:jenkins-reviewbot

Severity

Critical

Classification

CWE-74 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory VDB Entry Issue Tracking Mitigation Vendor Advisory