PT-2017-17873 · Apache · Apache Nifi

Published 2017-06-12 · Updated 2022-05-17 · CVE-2017-7667

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 0.7.4 Apache NiFi 1.x versions prior to 1.3.0

Description The issue arises from Apache NiFi's failure to establish a response header that instructs browsers to only allow framing from the same origin. This could potentially lead to security issues related to framing.

Recommendations For Apache NiFi versions prior to 0.7.4, update to version 0.7.4 or later. For Apache NiFi 1.x versions prior to 1.3.0, update to version 1.3.0 or later.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2017-7667

GHSA-JVX9-RJ3W-JQ99

Affected Products

Apache Nifi

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-7667 · Security Note
• https://osv.dev/vulnerability/GHSA-jvx9-rj3w-jq99 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7667 · Vendor Advisory
• https://lists.apache.org/thread.html/d779d6129de1a5aa149c219b2fc6e9e78156614eaac92a89cbaf9bce@%3Cdev.nifi.apache.org%3E · Note
• http://securityfocus.com/bid/99018 · Note
• https://lists.apache.org/thread.html/d779d6129de1a5aa149c219b2fc6e9e78156614eaac92a89cbaf9bce%40%3Cdev.nifi.apache.org%3E · Note