Unauthorized Access Via User Impersonation

Apache nifi is vulnerable to unauthorized access via user impersonation attacks. The vulnerability exists due to a possible injection attack in a cluster environment, in the proxy chain’s serialization/deserialization. A malicious user can inject >< in their username to impersonate another user to have unauthorized access on a replicated request to another node.