Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2017-15703

Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

CVSS v3:

  • Severity: Medium
  • Score: 5
  • AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

CVSS v2:

  • Severity: Low
  • Score: 3.5
  • AV:N/AC:M/Au:S/C:N/I:N/A:P

CWEs:

OWASP TOP 10:

Software From Fixed in
apache / nifi 1.0.0 1.4.0.x
org.apache.nifi / nifi-framework-cluster-protocol - 1.5.0