CVE-2017-5636

Published: Oct 19, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node.

Affected (4)

Products: Apache: Nifi

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Apache Nifi	Version 0.7.0
Apache Nifi	Version 0.7.1
Apache Nifi	Version 1.1.0
Apache Nifi	Version 1.1.1

Related CWEs

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (4)

http://www.securityfocus.com/bid/96731

Source: security@apache.org

Third Party AdvisoryVDB Entry

https://nifi.apache.org/security.html#CVE-2017-5636

Source: security@apache.org

Issue TrackingMitigationVendor Advisory

http://www.securityfocus.com/bid/96731

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://nifi.apache.org/security.html#CVE-2017-5636

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingMitigationVendor Advisory

Timeline

No history available yet.