GitHub Advisoryadvisory · Maven

GHSA-xwx6-vmj4-5rv8 Denial of service via deserialization attack in nifi

MEDIUM Published 2019-10-25 Modified 2021-08-18 Official page ↗
Aliases
CVE-2017-15703
Ecosystem
Maven
Packages
org.apache.nifi:nifi-framework-cluster-protocol
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-502
Reviewed
2019-10-25

Affected packages

• Maven org.apache.nifi:nifi-framework-cluster-protocol: < 1.5.0 → fixed in 1.5.0

Description

A vulnerability found in Apache NIFI before 1.5.0-RC1. Attacker can perform XXE attacks through JAXB.

Related

Alias · CVE (1)

  • CVE-2017-15703 Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References