CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10080
https://notcve.org/view.php?id=CVE-2019-10080
The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses. El XMLFileLookupService en NiFi versiones 1.3.0 hasta 1.9.2, permitió a usuarios confiables configurar inadvertidamente un archivo XML potencialmente malicioso. El archivo XML tiene la capacidad de realizar llamadas externas a los servicios (mediante XXE) y revelar información tal y como las versiones de Java, Jersey y Apache que utilizan la instancia de NiFi. • https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E https://nifi.apache.org/security.html#CVE-2019-10080 https://www.oracle.com/security-alerts/cpuApr2021.html • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-17195
https://notcve.org/view.php?id=CVE-2018-17195
The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access, and injecting malicious code into an unprotected (plaintext HTTP) website which the targeted user later visits, but the possible damage warranted a Severe severity level. Mitigation: The fix to apply Cross-Origin Resource Sharing (CORS) policy request filtering was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release. El endpoint de la API de subida de plantillas aceptaba peticiones de diferentes dominios al enviarse junto con un ataque de suplantación de ARP y otro Man-in-the-Middle (MitM), lo que resulta en un ataque Cross-Site Request Forgery (CSRF). • https://nifi.apache.org/security.html#CVE-2018-17195 • CWE-319: Cleartext Transmission of Sensitive Information CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-17192
https://notcve.org/view.php?id=CVE-2018-17192
The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Mitigation: The fix to consistently apply the security headers was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release. Las cabeceras X-Frame-Options se aplicaron de forma inconsistente en algunas respuestas HTTP, lo que resulta en cabeceras de seguridad duplicadas o faltantes. • https://nifi.apache.org/security.html#CVE-2018-17192 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-17193
https://notcve.org/view.php?id=CVE-2018-17193
The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack. Mitigation: The fix to correctly parse and sanitize the request attribute value was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release. La página de error message-page.jsp empleó el valor de la cabecera de petición HTTP X-ProxyContextPath sin sanear, lo que resulta en un ataque Cross-Site Scripting (XSS). Mitigación: La solución para analizar correctamente y sanear el valor del atributo de petición se aplicó en la distribución 1.8.0 de Apache NiFi. • https://nifi.apache.org/security.html#CVE-2018-17193 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-17194
https://notcve.org/view.php?id=CVE-2018-17194
When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and eventually timeout. Mitigation: The fix to check DELETE requests and overwrite non-zero Content-Length header values was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release. Cuando una petición de cliente a un nodo del clúster se replicó a otros nodos en el clúster para verificarlos, se redireccionó el Content-Length. • https://nifi.apache.org/security.html#CVE-2018-17194 • CWE-20: Improper Input Validation •