PT-2018-13943 · Apache · Apache Nifi

Suchithra V N · Published 2018-12-19 · Updated 2020-08-24 · CVE-2018-17192

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 1.8.0

Description The issue arises from inconsistent application of the X-Frame-Options headers in HTTP responses, leading to potential clickjacking attacks due to incorrect interpretation by some browsers.

Recommendations For Apache NiFi versions prior to 1.8.0, upgrade to Apache NiFi 1.8.0 or a later version to ensure consistent application of security headers and mitigate the risk of clickjacking attacks.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2018-17192

GHSA-2XPP-75VR-22VQ

Affected Products

Apache Nifi

References · 7

• https://nifi.apache.org/security.html#CVE-2018-17192 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2xpp-75vr-22vq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17192 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17192 · Vendor Advisory
• https://github.com/apache/nifi/commit/dbf259508c2b8e176d8cb837177aaadbf44f0670 · Note
• https://github.com/advisories/GHSA-2xpp-75vr-22vq · Note
• https://issues.apache.org/jira/browse/NIFI-5258 · Note