CVE-2017-15697
published 2018-01-23CVE-2017-15697: A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to…
PriorityP356critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
4.83%
91.0th percentile
A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | nifi | — | — |
| apache | nifi | 1.0.0 – 1.4.0 | — |
| apache_software_foundation | apache_nifi | — | — |
| apache_software_foundation | apache_nifi | — | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_apache9.8
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache NiFi XSS issue in context path handling
ghsa·2022-05-14
CVE-2017-15697 [CRITICAL] CWE-20 Apache NiFi XSS issue in context path handling
Apache NiFi XSS issue in context path handling
A malicious `X-ProxyContextPath` or `X-Forwarded-Context` header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
OSV
Apache NiFi XSS issue in context path handling
osv·2022-05-14
CVE-2017-15697 [CRITICAL] Apache NiFi XSS issue in context path handling
Apache NiFi XSS issue in context path handling
A malicious `X-ProxyContextPath` or `X-Forwarded-Context` header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Apache
Apache nifi: CVE-2017-15697
vendor_apache·CVSS 9.8
CVE-2017-15697 Apache nifi: CVE-2017-15697
Apache nifi: CVE-2017-15697
Title: Potential Cross-Site Scripting in Proxy Request Headers Published: 2018-01-12 Severity: Medium Products: Apache NiFi Affected Versions: 1.0.0 to 1.4.0 Fixed Versions: 1.5.0 Reporter: Andy LoPresto References CVE Record: CVE-2017-15697 NVD Record: CVE-2017-15697 Apache Jira Issue: NIFI-4501 GitHub Pull Request: 2279 A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. NiFi 1.5.0 includes corrected handling of these headers. Users running a prior release should upgrade to 1.5.0.
Severity: moderate
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-01-23
Published