CVE-2018-17193: XSS
The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack. Mitigation: The fix to correctly parse and sanitize the request attribute value was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-17193?
CVE-2018-17193 is a vulnerability that allows for a reflected XSS attack in the message-page.jsp error page of Apache NiFi.
How severe is CVE-2018-17193?
CVE-2018-17193 has a severity score of 6.1, which is considered medium.
How can I mitigate CVE-2018-17193?
To mitigate CVE-2018-17193, update to Apache NiFi 1.8.0 or later which includes a fix to correctly parse and sanitize the request attribute value.
What is the affected software for CVE-2018-17193?
The affected software for CVE-2018-17193 is Apache NiFi versions 1.0.0 to 1.7.1.
Are there any references for CVE-2018-17193?
Yes, you can find more information about CVE-2018-17193 at the following link: https://nifi.apache.org/security.html#CVE-2018-17193