CVE-2017-15697

CWE-20 — Improper Input Validation5 documents5 sources
Severity
9.8CRITICAL
EPSS
2.5%
top 14.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache NifiApache Software Foundation Apache Nifi
Timeline
PublishedJan 23
Latest updateMay 14

Description

A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶Mavenorg.apache.nifi:nifi1.0.0 — 1.5.0
▶NVDapache/nifi1.0.0 — 1.4.0
▶CVEListV5apache_software_foundation/apache_nifi0.1.0 - 0.7.x, 1.0.0 - 1.4.0+1

🔴Vulnerability Details

3
GHSA
Apache NiFi XSS issue in context path handling↗2022-05-14
▶
OSV
Apache NiFi XSS issue in context path handling↗2022-05-14
▶
CVEList
CVE-2017-15697: A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution↗2018-01-23
▶

📋Vendor Advisories

1
Apache
Apache nifi: CVE-2017-15697↗
▶
CVE-2017-15697 (CRITICAL CVSS 9.8) | A malicious X-ProxyContextPath or X | cvebase.io