CVE-2017-15703

Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of…

published January 25, 2018

CVSS
—
EPSS
1%
Percentile
58.1
In the wild
Unconfirmed
What it is

Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00862 · 58.1th percentile
Published
2018-01-25T21:00Z
EPSS history
Timeline
  • 25 JAN 21:00Z
    Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of…
    cvelistv5