Cross-site Request Forgery (CSRF)

nifi-web-api is vulnerable to cross-site request forgery CSRF attacks. The vulnerability exists due to the lack of Cross-Origin Resource Sharing CORS filter applied to the template/upload endpoint, allowing requests from different domains in the origin to be accepted...

org.apache.nifi:nifi-framework-nar (>=1.0.0, <=1.7.1), org.apache.nifi:nifi-jetty (>=1.0.0, <=1.7.1) +1 more potentially affected by CVE-2018-17194 via org.apache.nifi:nifi-framework-cluster (>=1.0.0, <=1.7.1)

org.apache.nifi:nifi-framework-cluster MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.7.1 Source cves: CVE-2018-17194 Source advisory: MEND:CVE-2018-17194...