Description

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user.

Remediation

References

http://www.securityfocus.com/bid/96730

https://nifi.apache.org/security.html#CVE-2017-5635

Related Vulnerabilities

CVE-2019-20174 Vulnerability in maven package org.webjars.bower:auth0-lock

CVE-2018-1000067 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2021-23425 Vulnerability in npm package trim-off-newlines

CVE-2017-1000244 Vulnerability in maven package org.jvnet.hudson.plugins:favorite

CVE-2017-16055 Vulnerability in npm package sqlserver

Severity

High

Classification

CWE-287 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Third Party Advisory VDB Entry Issue Tracking Mitigation Vendor Advisory