Description

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user.

Remediation

References

https://nifi.apache.org/security.html#CVE-2017-5635

http://www.securityfocus.com/bid/96730

Related Vulnerabilities

CVE-2023-48219 Vulnerability in maven package org.webjars:tinymce

CVE-2022-2576 Vulnerability in maven package org.eclipse.californium:californium-core

CVE-2022-39353 Vulnerability in maven package org.webjars.npm:xmldom__xmldom

CVE-2021-46708 Vulnerability in maven package org.webjars.npm:swagger-ui

CVE-2018-16461 Vulnerability in npm package libnmap

Severity

High

Classification

CWE-287 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Issue Tracking Mitigation Vendor Advisory Third Party Advisory VDB Entry