CVE-2017-5636
published 2017-10-19CVE-2017-5636: In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack…
PriorityP351critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
3.60%
88.2th percentile
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | nifi | — | — |
| apache | nifi | — | — |
| apache | nifi | — | — |
| apache | nifi | — | — |
| apache | nifi | — | — |
| apache_software_foundation | apache_nifi | — | — |
| apache_software_foundation | apache_nifi | — | — |
| apache_software_foundation | apache_nifi | — | — |
| apache_software_foundation | apache_nifi | — | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_apache9.8
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apache
Apache nifi: CVE-2017-5636
vendor_apache·CVSS 9.8
CVE-2017-5636 Apache nifi: CVE-2017-5636
Apache nifi: CVE-2017-5636
Title: Improper Authentication of Replicated Cluster HTTP Requests Published: 2017-02-20 Severity: Medium Products: Apache NiFi Affected Versions: 0.7.0 to 0.7.1 and 1.1.0 to 1.1.1 Fixed Versions: 0.7.2 and 1.1.2 Reporter: Andy LoPresto References CVE Record: CVE-2017-5636 NVD Record: CVE-2017-5636 Apache Jira Issue: NIFI-3487 In a cluster environment, the proxy chain serialization and deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node. NiFi 0.7.2 and 1.1.2 modify the tokenization code and sanitization of user-provided input. Users running a prior release should upgrade to 0.7.2 or 1.1.2.
Severity: moderate
OSV
Injection in Apache NiFi
osv·2022-05-17
CVE-2017-5636 [CRITICAL] Injection in Apache NiFi
Injection in Apache NiFi
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node.
GHSA
Injection in Apache NiFi
ghsa·2022-05-17
CVE-2017-5636 [CRITICAL] CWE-74 Injection in Apache NiFi
Injection in Apache NiFi
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-10-19
Published