GHSA-xwx6-vmj4-5rv8

    Dashboard / Vulnerabilities / GHSA-xwx6-vmj4-5rv8

    GHSA-xwx6-vmj4-5rv8

    Published: 25 Oct 2019Last Modified: 8 Nov 2023

    Summary: Denial of service via deserialization attack in nifi

    Details: A vulnerability found in Apache NIFI before 1.5.0-RC1. Attacker can perform XXE attacks through JAXB.

    References: https://github.com/apache/nifi/commit/9e2c7be7d3c6a380c5f61074d9a5a690b617c3dc

    Affected packages

    Package

    Name: org.apache.nifi:nifi-framework-cluster-protocol

    Purl: pkg:maven/org.apache.nifi/nifi-framework-cluster-protocol

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.5.0

    Affected versions

    0.0.1-incubating
    0.0.2-incubating

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High