CVE-2017-15697 Security Details

CVE ID

CVE-2017-15697

CWE

CWE-20

CVE Description

A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

Published

Jul 23, 2018

CVSS Score & Severity

9.8Critical

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

2.452%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/apache/nifi/registry/jetty/JettyServer.<init>(Lorg/apache/nifi/registry/properties/NiFiRegistryProperties;Lorg/apache/nifi/registry/security/crypto/CryptoKeyProvider;Ljava/lang/String;)V

JVMVulnerable params: 1

org/apache/nifi/registry/web/api/ApplicationResource.generateResourceUri([Ljava/lang/String;)Ljava/lang/String;

JVMVulnerable params: 0

org/apache/nifi/web/api/ApplicationResource.generateResourceUri([Ljava/lang/String;)Ljava/lang/String;

JVMVulnerable params: 0

org/apache/nifi/web/filter/CatchAllFilter.doFilter(Ljavax/servlet/ServletRequest;Ljavax/servlet/ServletResponse;Ljavax/servlet/FilterChain;)V

JVMVulnerable params: 0

org/apache/nifi/web/server/JettyServer.<init>(Lorg/apache/nifi/util/NiFiProperties;Ljava/util/Set;)V

JVMVulnerable params: 1

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · PR #2279PROJECT

Apache Jira · NIFI-4501PROJECT

Apache · Security advisoryPROJECT