CVE-2017-5636: Critical severity Apache nifi vulnerability
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5636?
CVE-2017-5636 has been classified as a critical vulnerability due to its potential to allow unauthorized user impersonation in Apache NiFi.
How do I fix CVE-2017-5636?
To fix CVE-2017-5636, you should upgrade to Apache NiFi version 1.1.2 or later, or 0.7.2.
What kind of attack does CVE-2017-5636 expose systems to?
CVE-2017-5636 exposes systems to injection attacks where crafted usernames can exploit user impersonation vulnerabilities.
Is CVE-2017-5636 applicable to all versions of Apache NiFi?
CVE-2017-5636 is applicable to Apache NiFi versions 0.7.0, 0.7.1, 1.1.0, and 1.1.1 prior to their corresponding patches.
What impact does CVE-2017-5636 have on clustered environments?
In clustered environments, CVE-2017-5636 allows attackers to gain unauthorized permissions on replicated requests, resulting in security breaches.