Denial of service via deserialization attack in nifi

MÉDIO 5.0CVE-2017-15703 · GHSA-xwx6-vmj4-5rv8 · Published 25/01/2018 · updated 17/06/2026

Em resumo

CVE-2017-15703 é uma vulnerabilidade MÉDIO (CVSS 5.0) que afeta org.apache.nifi:nifi-framework-cluster-protocol, nifi (apache).
Chance de exploração nos próximos 30 dias (EPSS): 0.86%, maior que 58.6% das vulnerabilidades.
Correção: atualize para 1.5.0 ou posterior.

Package	Affected versions	Patched versions
org.apache.nifi:nifi-framework-cluster-protocol Maven	`< 1.5.0`	`1.5.0`
nifi apache	`≥ 1.0.0, ≤ 1.4.0`	No fix yet

Description

A vulnerability found in Apache NIFI before 1.5.0-RC1. Attacker can perform XXE attacks through JAXB.

NVD description

Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

References

apache/nifi commit 9e2c7be · WEB
nifi.apache.org/security.html · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free