Denial of service via deserialization attack in nifi

MEDIUM 5.0CVE-2017-15703 · GHSA-xwx6-vmj4-5rv8 · Published 25/01/2018 · updated 17/06/2026

In short

CVE-2017-15703 is a MEDIUM (CVSS 5.0) vulnerability affecting org.apache.nifi:nifi-framework-cluster-protocol, nifi (apache).
Chance of exploitation in the next 30 days (EPSS): 0.86%, higher than 58.6% of all vulnerabilities.
Fix: update to 1.5.0 or later.

Package	Affected versions	Patched versions
org.apache.nifi:nifi-framework-cluster-protocol Maven	`< 1.5.0`	`1.5.0`
nifi apache	`≥ 1.0.0, ≤ 1.4.0`	No fix yet

Description

A vulnerability found in Apache NIFI before 1.5.0-RC1. Attacker can perform XXE attacks through JAXB.

NVD description

Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

References

apache/nifi commit 9e2c7be · WEB
nifi.apache.org/security.html · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free