Non notée
CVE-2017-15703 Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained…
Description
Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache NiFi | Versions non publiées |
Références
- nifi.apache.org nifi.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache NiFi
Les 47 CVE de Apache NiFi →
CVE-2026-70469
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests…
Non notée
CVE-2026-81866
Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not…
0.5
Faible
CVE-2026-82561
Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a…
5.9
Moyenne
CVE-2026-86089
Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API…
2.3
Faible