CVE-2017-5636

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 0.7.2 Apache NiFi versions 1.x prior to 1.1.2

Description The issue allows a carefully crafted username to impersonate another user and gain their permissions on a replicated request to another node in a cluster environment. This is due to a vulnerability in the proxy chain serialization/deserialization.

Recommendations For Apache NiFi versions prior to 0.7.2, update to version 0.7.2 or later. For Apache NiFi versions 1.x prior to 1.1.2, update to version 1.1.2 or later.