GHSA-w4x6-j349-9r57

    Dashboard / Vulnerabilities / GHSA-w4x6-j349-9r57

    GHSA-w4x6-j349-9r57

    Published: 14 May 2022Last Modified: 8 Nov 2023

    Summary: Apache NiFi host header poisoning issue

    Details: A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to a controlled whitelist was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

    References: https://nvd.nist.gov/vuln/detail/CVE-2017-12632, https://nifi.apache.org/security.html#CVE-2017-12632

    Affected packages

    Package

    Name: org.apache.nifi:nifi

    Purl: pkg:maven/org.apache.nifi/nifi

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 1.0.0
    Fixed -1.5.0

    Affected versions

    1.0.0
    1.0.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High