CVE-2017-12632

published 2018-01-23

CVE-2017-12632: A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to…

Priority P3 40 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C N I H A N

A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to a controlled whitelist was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
apache	nifi	<= 1.4.0	—
apache	nifi	—	—
apache_software_foundation	apache_nifi	—	—
apache_software_foundation	apache_nifi	—	—

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:P/A:N

vendor_apache 7.5

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20