CVE-2017-15703

Name of the Vulnerable Software and Affected Versions: Apache NiFi versions prior to 1.4.0 Apache NiFi versions prior to 1.5.0-RC1

Description: The issue allows any authenticated user to upload a template containing malicious code, potentially causing a denial of service via Java deserialization attack. Additionally, an attacker can perform XXE attacks through JAXB.

Recommendations: For Apache NiFi versions prior to 1.4.0, upgrade to Apache NiFi 1.4.0 or later to properly handle Java deserialization and mitigate the risk of denial of service attacks. For Apache NiFi versions prior to 1.5.0-RC1, upgrade to Apache NiFi 1.5.0-RC1 or later to prevent XXE attacks through JAXB.