VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Oct 19, 2017· Updated Jun 17, 2026

CVE-2017-5636

CVE-2017-5636

Description

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.nifi:nifiMaven
< 0.7.20.7.2
org.apache.nifi:nifiMaven
>= 1.0.0, < 1.1.21.1.2

Affected products

6
  • Apache/Nifi4 versions
    cpe:2.3:a:apache:nifi:0.7.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:apache:nifi:0.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:nifi:0.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:nifi:1.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:nifi:1.1.1:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.apache.nifi/nifi
    Range: < 0.7.2
  • Apache/Apachecpe-rescue
    Range: 0.7.0

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.