GHSA-jrcc-7jf5-3pxgCriticalCVSS 9.8

Injection in Apache NiFi

Published
May 17, 2022
Last Modified
January 30, 2023

🔗 CVE IDs covered (1)

CVE-2017-5636 →

📋 Description

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node.

🎯 Affected products2

  • maven/org.apache.nifi:nifi:< 0.7.2
  • maven/org.apache.nifi:nifi:>= 1.0.0, < 1.1.2

🔗 References (4)