Cross-site Scripting (XSS)

2017-06-1202:31:54

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

50.9%

JSON

nifi-jetty is vulnerable to cross-site scripting (XSS) attacks. A malicious user can inject and execute arbitrary JavaScript because the library does have the sufficient response headers to only allow framing from the same origin.

CPENameOperatorVersion
nifi-jettyle1.2.0
nifi-jettyle0.7.3
nifi-framework-corele1.2.0

Name	Operator	Version
nifi-jetty	le	1.2.0
nifi-jetty	le	0.7.3
nifi-framework-core	le	1.2.0

References

seclists.org/oss-sec/2017/q2/453

issues.apache.org/jira/browse/NIFI-3907

0.001 Low

EPSS

Percentile

50.9%

JSON

Related for VERACODE:4413