PT-2018-13946 · Apache · Apache Nifi

Mike Cole · Publicado 2018-12-19 · Atualizado 2020-08-24 · CVE-2018-17195

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 1.8.0

Description The template upload API endpoint is susceptible to a CSRF attack when combined with ARP spoofing and a man-in-the-middle (MiTM) attack. This complex attack vector requires client certificate authentication, same subnet access, and the injection of malicious code into an unprotected website that the targeted user later visits. The potential damage from this attack warrants a severe severity level.

Recommendations For Apache NiFi versions prior to 1.8.0, upgrade to version 1.8.0 or later to apply the Cross-Origin Resource Sharing (CORS) policy request filtering fix.

Correção

Cleartext Transmission of Sensitive Information

Incorrect Authorization

Enumeração de Fraquezas

CWE-319

CWE-863

Identificadores relacionados

CVE-2018-17195

GHSA-3JQ8-JG75-RQV6

Produtos afetados

Apache Nifi

Referências · 7

• https://github.com/apache/nifi/commit/246c090526143943557b15868db6e8fe3fb30cf6 · Nota
• https://osv.dev/vulnerability/CVE-2018-17195 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17195 · Nota de Segurança
• https://nifi.apache.org/security.html#CVE-2018-17195 · Aviso do Fabricante
• https://issues.apache.org/jira/browse/NIFI-5595 · Nota
• https://osv.dev/vulnerability/GHSA-3jq8-jg75-rqv6 · Aviso do Fabricante
• https://github.com/advisories/GHSA-3jq8-jg75-rqv6 · Nota