PT-2018-13943 · Apache · Apache Nifi

Suchithra V N · Publicado 2018-12-19 · Atualizado 2020-08-24 · CVE-2018-17192

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 1.8.0

Description The issue arises from inconsistent application of the X-Frame-Options headers in HTTP responses, leading to potential clickjacking attacks due to incorrect interpretation by some browsers.

Recommendations For Apache NiFi versions prior to 1.8.0, upgrade to Apache NiFi 1.8.0 or a later version to ensure consistent application of security headers and mitigate the risk of clickjacking attacks.

Correção

Clickjacking

Enumeração de Fraquezas

CWE-1021

Identificadores relacionados

CVE-2018-17192

GHSA-2XPP-75VR-22VQ

Produtos afetados

Apache Nifi

Referências · 7

• https://github.com/apache/nifi/commit/dbf259508c2b8e176d8cb837177aaadbf44f0670 · Nota
• https://nifi.apache.org/security.html#CVE-2018-17192 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-2xpp-75vr-22vq · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17192 · Nota de Segurança
• https://github.com/advisories/GHSA-2xpp-75vr-22vq · Nota
• https://issues.apache.org/jira/browse/NIFI-5258 · Nota
• https://osv.dev/vulnerability/CVE-2018-17192 · Aviso do Fabricante