CVE-2017-5635

In Apache NiFi, versions before 0.7.2 and before 1.1.2 in a cluster environment are affected. When an anonymous user request is replicated to another node, the originating node identity is used instead of the anonymous user. Root cause: misattribution of the user identity across cluster replicati...

CVE-2017-5635

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user...

CVE-2017-5636

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node...

CVE-2017-5635: Improper Authentication

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user...

CVE-2016-8748: Improper Neutralization of Input During Web Page Generation

In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM...

PT-2017-9779

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 1.0.1 Apache NiFi versions 1.1.x prior to 1.1.1 Description The issue is related to a cross-site scripting vulnerability in the connection details dialog. This occurs when an authorized user accesses the dialog an...

PT-2017-16636

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 0.7.2 Apache NiFi versions 1.x prior to 1.1.2 Description The issue allows a carefully crafted username to impersonate another user and gain their permissions on a replicated request to another node in a cluster...

PT-2017-16635

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 0.7.2 Apache NiFi versions 1.x prior to 1.1.2 Description The issue arises in a cluster environment when an anonymous user request is replicated to another node. Instead of using the "anonymous" user identity, the...

CVE-2017-5636: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node...

XML External Entities (XXE) Attacks

apache-nifi is vulnerable to XML External Entities XXE attacks. The library does not properly handle XML template files, allowing a malicious user to inject external entities that can lead to sensitive information being displayed...

CVE-2017-12623

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...

Xxe

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...

CVE-2017-12623

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...

CVE-2017-12623

CVE-2017-12623 concerns Apache NiFi where an authorized user could upload a template containing malicious code and trigger an XML External Entity (XXE) attack to access sensitive files. The root cause is improper handling of XML external entities within uploaded templates. The fixed behavior was ...

CVE-2017-12623

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...

CVE-2017-12623

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...

PT-2017-12607

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 1.4.0 Description The issue allows an authorized user to upload a template containing malicious code, which can then access sensitive files via an XML External Entity XXE attack. This occurs due to improper handli...

CVE-2017-12623: Improper Restriction of XML External Entity Reference

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...

Apache NiFi Cross-Site Scripting Vulnerability (CNVD-2017-14424)

Apache NiFi is a system data flow automation solution. Apache NiFi suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack user sessions...

Input validation

In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient...