PT-2018-13946 · Apache · Apache Nifi

Mike Cole · Published 2018-12-19 · Updated 2020-08-24 · CVE-2018-17195

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 1.8.0

Description The template upload API endpoint is susceptible to a CSRF attack when combined with ARP spoofing and a man-in-the-middle (MiTM) attack. This complex attack vector requires client certificate authentication, same subnet access, and the injection of malicious code into an unprotected website that the targeted user later visits. The potential damage from this attack warrants a severe severity level.

Recommendations For Apache NiFi versions prior to 1.8.0, upgrade to version 1.8.0 or later to apply the Cross-Origin Resource Sharing (CORS) policy request filtering fix.

Fix

Cleartext Transmission of Sensitive Information

Incorrect Authorization

Weakness Enumeration

CWE-319

CWE-863

Related Identifiers

CVE-2018-17195

GHSA-3JQ8-JG75-RQV6

Affected Products

Apache Nifi

References · 7

• https://osv.dev/vulnerability/CVE-2018-17195 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17195 · Security Note
• https://nifi.apache.org/security.html#CVE-2018-17195 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3jq8-jg75-rqv6 · Vendor Advisory
• https://github.com/apache/nifi/commit/246c090526143943557b15868db6e8fe3fb30cf6 · Note
• https://issues.apache.org/jira/browse/NIFI-5595 · Note
• https://github.com/advisories/GHSA-3jq8-jg75-rqv6 · Note