CVE-2016-8748

CWE-79 — Cross-site Scripting (XSS)6 documents6 sources
Severity
5.4MEDIUM
EPSS
0.4%
top 38.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache NifiApache Software Foundation Apache Nifi
Timeline
PublishedOct 19
Latest updateMay 14

Description

In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶Mavenorg.apache.nifi:nifi1.1.0 — 1.1.1+1
▶NVDapache/nifi1.0.0+1
▶CVEListV5apache_software_foundation/apache_nifi1.0.0, 1.1.0+1

🔴Vulnerability Details

3
OSV
Cross-site Scripting in Apache NiFi↗2022-05-14
▶
GHSA
Cross-site Scripting in Apache NiFi↗2022-05-14
▶
CVEList
CVE-2016-8748: In Apache NiFi before 1↗2017-10-19
▶

📋Vendor Advisories

1
Apache
Apache nifi: CVE-2016-8748↗
▶

💬Community

1
Bugzilla
CVE-2015-8747 CVE-2015-8748 radicale: Multiple security issues fixed in 1.1↗2016-01-05
▶
CVE-2016-8748 (MEDIUM CVSS 5.4) | In Apache NiFi before 1.0.1 and 1.1 | cvebase.io