CVE-2017-15697 Apache NiFi XSS issue in context path handling
CriticalCVSS 9.8
EPSS 4.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.nifi/nifi(Maven) | >= 1.0.0, < 1.5.0 | 1.5.0 |
| org.apache.nifi/nifi(Maven) | = 1.0.0 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.0.1 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.1.0 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.1.1 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.1.2 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.2.0 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.3.0 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.4.0 | No fix listed |
| apache nifi | >= 1.0.0, <= 1.4.0 | No fix listed |
| Apache NiFi | = 1.0.0 - 1.4.0 | No fix listed |
| Apache NiFi | = 0.1.0 - 0.7.x | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- nifi.apache.org vendor-advisory
- github.com