PT-2017-16636 · Apache · Apache Nifi

Andy Lopresto · Published 2017-10-19 · Updated 2022-05-17 · CVE-2017-5636

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 0.7.2 Apache NiFi versions 1.x prior to 1.1.2

Description The issue allows a carefully crafted username to impersonate another user and gain their permissions on a replicated request to another node in a cluster environment. This is due to a vulnerability in the proxy chain serialization/deserialization.

Recommendations For Apache NiFi versions prior to 0.7.2, update to version 0.7.2 or later. For Apache NiFi versions 1.x prior to 1.1.2, update to version 1.1.2 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2017-5636

GHSA-JRCC-7JF5-3PXG

Affected Products

Apache Nifi

References · 5

• https://nifi.apache.org/security.html#CVE-2017-5636 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5636 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5636 · Security Note
• https://osv.dev/vulnerability/GHSA-jrcc-7jf5-3pxg · Vendor Advisory
• http://securityfocus.com/bid/96731 · Note