CVE-2017-5635

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache NiFi	0.7.0; 0.7.1; 1.1.0; 1.1.1

References

http://www.securityfocus.com/bid/96730Third Party Advisory, VDB Entry
https://nifi.apache.org/security.html#CVE-2017-5635Issue Tracking, Mitigation, Vendor Advisory
http://www.securityfocus.com/bid/96730Third Party Advisory, VDB Entry
https://nifi.apache.org/security.html#CVE-2017-5635Issue Tracking, Mitigation, Vendor Advisory

Timeline

Published: Oct 19, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-56369.8In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an CVE-2017-56377.5Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, w CVE-2017-56389.8The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-mes CVE-2017-56409.8It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemo CVE-2017-56419.8Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by CVE-2017-56429.8During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs.CVE-2017-56437.4Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.CVE-2017-56445.5Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted CVE-2017-56459.8In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another applic CVE-2017-56466.8For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while a CVE-2017-56477.5A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.7 CVE-2017-56489.1While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.