Description

A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

Remediation

References

https://nifi.apache.org/security.html#CVE-2017-15697

Related Vulnerabilities

CVE-2022-28890 Vulnerability in maven package org.apache.jena:jena-core

CVE-2022-25210 Vulnerability in maven package com.convertigo.jenkins.plugins:convertigo-mobile-platform

CVE-2018-14042 Vulnerability in maven package org.webjars.npm:bootstrap

CVE-2022-34210 Vulnerability in maven package org.jenkins-ci.plugins:threadfix

CVE-2019-10249 Vulnerability in maven package org.eclipse.xtext:org.eclipse.xtext.maven.parent

Severity

Critical

Classification

CWE-20 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory