Description

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user.

Remediation

References

https://nifi.apache.org/security.html#CVE-2017-5635

http://www.securityfocus.com/bid/96730

Related Vulnerabilities

CVE-2023-35161 Vulnerability in maven package org.xwiki.platform:xwiki-platform-appwithinminutes-ui

CVE-2019-16555 Vulnerability in maven package com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

CVE-2015-5169 Vulnerability in maven package org.apache.struts:struts2-core

CVE-2019-5423 Vulnerability in npm package http-live-simulator

CVE-2019-1003087 Vulnerability in maven package org.jenkins-ci.plugins:labmanager

Severity

High

Classification

CWE-287 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Issue Tracking Mitigation Vendor Advisory Third Party Advisory VDB Entry