CVE-2018-17192 Improper Restriction of Rendered UI Layers or Frames in Apache nifif
MediumCVSS 6.5
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Mitigation: The fix to consistently apply the security headers was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.nifi/nifi(Maven) | >= 1.0.0, < 1.8.0 | 1.8.0 |
| org.apache.nifi/nifi(Maven) | = 1.0.0 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.0.1 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.1.0 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.1.1 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.1.2 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.2.0 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.3.0 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.4.0 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.5.0 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.6.0 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.7.0 | No fix listed |
| org.apache.nifi/nifi(Maven) | = 1.7.1 | No fix listed |
| org.apache.nifi/nifi(Maven) | >= 1.0.0, <= 1.6.0 | No fix listed |
| apache nifi | >= 1.0.0, <= 1.6.0 | No fix listed |
| Apache NiFi | = Apache NiFi 1.0.0 - 1.7.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com vendor-advisory
- issues.apache.org
- nifi.apache.org vendor-advisory