What is CVE-2018-17193?

CVE-2018-17193 is a vulnerability that allows for a reflected XSS attack in the message-page.jsp error page of Apache NiFi.

How severe is CVE-2018-17193?

CVE-2018-17193 has a severity score of 6.1, which is considered medium.

How can I mitigate CVE-2018-17193?

To mitigate CVE-2018-17193, update to Apache NiFi 1.8.0 or later which includes a fix to correctly parse and sanitize the request attribute value.

What is the affected software for CVE-2018-17193?

The affected software for CVE-2018-17193 is Apache NiFi versions 1.0.0 to 1.7.1.

Are there any references for CVE-2018-17193?

Yes, you can find more information about CVE-2018-17193 at the following link: https://nifi.apache.org/security.html#CVE-2018-17193

Vulnerability/
CVE-2018-17193

medium

6.1

CWE

19/12/2018

20/12/2018

5/8/2024

CVE-2018-17193: XSS

First published: Wed Dec 19 2018(Updated: )

The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack. Mitigation: The fix to correctly parse and sanitize the request attribute value was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

Credit: security@apache.org security@apache.org

Affected Software	Affected Version	How to fix
Apache NiFi	>=1.0.0<=1.7.1
maven/org.apache.nifi:nifi	>=1.0.0<=1.7.1	1.8.0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2018-17193?
CVE-2018-17193 is a vulnerability that allows for a reflected XSS attack in the message-page.jsp error page of Apache NiFi.
How severe is CVE-2018-17193?
CVE-2018-17193 has a severity score of 6.1, which is considered medium.
How can I mitigate CVE-2018-17193?
To mitigate CVE-2018-17193, update to Apache NiFi 1.8.0 or later which includes a fix to correctly parse and sanitize the request attribute value.
What is the affected software for CVE-2018-17193?
The affected software for CVE-2018-17193 is Apache NiFi versions 1.0.0 to 1.7.1.
Are there any references for CVE-2018-17193?
Yes, you can find more information about CVE-2018-17193 at the following link: https://nifi.apache.org/security.html#CVE-2018-17193

collector/nvd-index
agent/type
collector/github-advisory-latest
source/GitHub
alias/GHSA-4qq9-rrq6-48ff
alias/CVE-2018-17193
agent/software-canonical-lookup
agent/weakness
agent/softwarecombine
agent/references
agent/description
agent/severity
collector/nvd-cve
source/NVD
agent/author
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/event
agent/first-publish-date
agent/trending
agent/tags
agent/source
vendor/apache
canonical/apache nifi
version/apache nifi/1.0.0
version/apache nifi/1.7.1
package-manager/maven

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.