CVE-2017-5635: High severity Apache nifi vulnerability
Published Oct 19, 2017
·Updated
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user.
Affected Software
4 affected components
Apache nifi=0.7.0
Apache nifi=0.7.1
Apache nifi=1.1.0
Apache nifi=1.1.1
Event History
Oct 19, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-5635?
CVE-2017-5635 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2017-5635?
To fix CVE-2017-5635, upgrade to Apache NiFi version 0.7.2 or 1.1.2 or later.
3
What systems are affected by CVE-2017-5635?
CVE-2017-5635 affects Apache NiFi versions 0.7.0, 0.7.1, 1.1.0, and 1.1.1.
4
What is the impact of CVE-2017-5635?
The impact of CVE-2017-5635 allows unauthorized users to appear as authenticated users in a cluster environment.
5
Is CVE-2017-5635 a remote vulnerability?
Yes, CVE-2017-5635 can be exploited remotely by an anonymous user if replication occurs in a cluster.