CVE-2017-15697

Name of the Vulnerable Software and Affected Versions: Apache NiFi versions prior to 1.5.0

Description: A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution.

Recommendations: For Apache NiFi versions prior to 1.5.0, upgrade to Apache NiFi 1.5.0 or a later version to properly handle these headers and prevent remote code execution. As a temporary workaround, consider restricting access to the X-ProxyContextPath and X-Forwarded-Context headers until a patch is applied.