VYPR
← All advisories
High severity7.5NVD Advisory· Published Oct 19, 2017· Updated May 13, 2026

CVE-2017-5635

CVE-2017-5635

Description

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.nifi:nifiMaven
< 0.7.20.7.2
org.apache.nifi:nifiMaven
>= 1.0.0, < 1.1.21.1.2

Affected products

5
  • Apache/Nifi4 versions
    cpe:2.3:a:apache:nifi:0.7.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:apache:nifi:0.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:nifi:0.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:nifi:1.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:nifi:1.1.1:*:*:*:*:*:*:*
  • Apache Software Foundation/Apache NiFiv5
    Range: 0.7.0

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.