Description

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user.

Remediation

References

http://www.securityfocus.com/bid/96730

https://nifi.apache.org/security.html#CVE-2017-5635

Related Vulnerabilities

CVE-2018-19056 Vulnerability in maven package org.webjars.bowergithub.pandao:editor.md

CVE-2021-42697 Vulnerability in maven package com.typesafe.akka:akka-http-core_2.13

CVE-2021-37712 Vulnerability in npm package tar

CVE-2017-1000404 Vulnerability in maven package se.diabol.jenkins.pipeline:delivery-pipeline-plugin

CVE-2021-3666 Vulnerability in npm package body-parser-xml

Severity

High

Classification

CWE-287 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Third Party Advisory VDB Entry Issue Tracking Mitigation Vendor Advisory