PT-2017-17873 · Apache · Apache Nifi

Publicado 2017-06-12 · Atualizado 2022-05-17 · CVE-2017-7667

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 0.7.4 Apache NiFi 1.x versions prior to 1.3.0

Description The issue arises from Apache NiFi's failure to establish a response header that instructs browsers to only allow framing from the same origin. This could potentially lead to security issues related to framing.

Recommendations For Apache NiFi versions prior to 0.7.4, update to version 0.7.4 or later. For Apache NiFi 1.x versions prior to 1.3.0, update to version 1.3.0 or later.

Correção

Origin Validation Error

Enumeração de Fraquezas

CWE-346

Identificadores relacionados

CVE-2017-7667

GHSA-JVX9-RJ3W-JQ99

Produtos afetados

Apache Nifi

Referências · 6

• https://lists.apache.org/thread.html/d779d6129de1a5aa149c219b2fc6e9e78156614eaac92a89cbaf9bce@%3Cdev.nifi.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7667 · Nota de Segurança
• http://securityfocus.com/bid/99018 · Nota
• https://osv.dev/vulnerability/GHSA-jvx9-rj3w-jq99 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-7667 · Aviso do Fabricante
• https://lists.apache.org/thread.html/d779d6129de1a5aa149c219b2fc6e9e78156614eaac92a89cbaf9bce%40%3Cdev.nifi.apache.org%3E · Nota