A malicious X-ProxyContextPath
or X-Forwarded-Context
header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
{ "nvd_published_at": "2018-01-23T22:29:00Z", "github_reviewed_at": "2022-11-01T22:11:54Z", "severity": "CRITICAL", "github_reviewed": true, "cwe_ids": [ "CWE-20" ] }