Apache NiFi Multiple Cross-Site Scripting Vulnerabilities (CVE-2017-15697)

Apache NiFi Multiple Cross-Site Scripting Vulnerabilities (CVE-2017-15697)
Apache NiFi Multiple Cross-Site Scripting Vulnerabilities (CVE-2017-15697)

Release date:
Updated on:

Affected Systems:

Apache Group NiFi <1.5.0

Description:

Bugtraq id: 102815
CVE (CAN) ID: CVE-2017-15697

Apache NiFi is an automated platform for data flow in software systems.

In versions earlier than Apache NiFi 1.5.0, X-ProxyContextPath or X-Forwarded-Context has a security vulnerability in implementation. After successful exploitation, remote code execution may occur.

<* Source: Andy LoPresto
*>

Suggestion:

Vendor patch:

Apache Group
------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Https://nifi.apache.org/
Https://nifi.apache.org/security.html#CVE-2017-15697