VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Oct 19, 2017· Updated May 13, 2026

CVE-2017-5636

CVE-2017-5636

Description

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.nifi:nifiMaven
< 0.7.20.7.2
org.apache.nifi:nifiMaven
>= 1.0.0, < 1.1.21.1.2

Affected products

5
  • Apache/Nifi4 versions
    cpe:2.3:a:apache:nifi:0.7.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:apache:nifi:0.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:nifi:0.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:nifi:1.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:nifi:1.1.1:*:*:*:*:*:*:*
  • Apache Software Foundation/Apache NiFiv5
    Range: 0.7.0

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.