CVE-2017-12623

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...

Xxe

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...

CVE-2017-12623

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...

CVE-2017-12623

CVE-2017-12623 concerns Apache NiFi where an authorized user could upload a template containing malicious code and trigger an XML External Entity (XXE) attack to access sensitive files. The root cause is improper handling of XML external entities within uploaded templates. The fixed behavior was ...

CVE-2017-12623

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...

CVE-2017-12623: Improper Restriction of XML External Entity Reference

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...

Apache NiFi Cross-Site Scripting Vulnerability (CNVD-2017-14424)

Apache NiFi is a system data flow automation solution. Apache NiFi suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack user sessions...

Input validation

In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient...

CVE-2017-7667

Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin...

CVE-2017-7667

Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin...

Design/Logic Flaw

Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin...

CVE-2017-7665

In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient...

CVE-2017-7667

CVE-2017-7667 affects Apache NiFi versions prior to 0.7.4 and 1.x prior to 1.3.0. The issue is an Origin Validation/Framing problem where NiFi did not set a suitable X-Frame-Options header, leaving the application vulnerable to cross-frame framing attacks. Connected advisories (GHSA/JQ99, CNVD/CN...

CVE-2017-7665

In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient...

CVE-2017-7665

CVE-2017-7665 : In Apache NiFi, before 0.7.4 and 1.x before 1.3.0, certain UI input components did not sufficiently guard against some forms of XSS. This is a cross-site scripting vulnerability in the NiFi web UI due to insufficient input validation in UI components. Connected advisories (GHSA-M5...

CVE-2017-7665: Improper Neutralization of Input During Web Page Generation

In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient...

CVE-2017-7667: Origin Validation Error

Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin...

Apache NiFi Remote Code Injection Vulnerability

Apache NiFi is an automated solution for data transfer between systems. Apache NiFi suffers from a remote code injection vulnerability. An attacker can exploit this vulnerability to execute arbitrary code in the context of a user running in an affected application, with a failed attack resulting ...

Apache NiFi Security Bypass Vulnerability

Apache NiFi is an automated solution for data transfer between systems. A security bypass vulnerability exists in Apache NiFi. An attacker could use this vulnerability to bypass security restrictions, perform unauthorized operations, and launch further attacks...

Unauthorized Access Via User Impersonation

Apache nifi is vulnerable to unauthorized access via user impersonation attacks. The vulnerability exists due to a possible injection attack in a cluster environment, in the proxy chain's serialization/deserialization. A malicious user can inject in their username to impersonate another user to...