« Volver al listado

CVE-2017-7665

Estado: ModificadaMedia (6.1)—

En Apache NiFi anterior a versión 0.7.4 y versión 1.x anterior a 1.3.0, se presentan ciertos componentes de entrada de usuario en la interfaz de usuario (UI) que habían estado protegiendo algunas formas de XSS reflejado pero fueron insuficientes.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Nifi

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-7665",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache NiFi",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.1 to 0.7.3"
            },
            {
              "status": "affected",
              "version": "1.0.0 to 1.2.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-06-12T16:29:00.217",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/99009",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/d779d6129de1a5aa149c219b2fc6e9e78156614eaac92a89cbaf9bce%40%3Cdev.nifi.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/99009",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/d779d6129de1a5aa149c219b2fc6e9e78156614eaac92a89cbaf9bce%40%3Cdev.nifi.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient."
    },
    {
      "lang": "es",
      "value": "En Apache NiFi anterior a versión 0.7.4 y versión 1.x anterior a 1.3.0, se presentan ciertos componentes de entrada de usuario en la interfaz de usuario (UI) que habían estado protegiendo algunas formas de XSS reflejado pero fueron insuficientes."
    }
  ],
  "lastModified": "2026-06-17T01:24:55.697",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "956E1F75-9430-4031-B908-2DFFA7CE22B8",
              "versionEndIncluding": "0.7.3"
            },
            {
              "criteria": "cpe:2.3:a:apache:nifi:1.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C028889E-44E8-4E54-9585-BF9B0EED5A9A"
            },
            {
              "criteria": "cpe:2.3:a:apache:nifi:1.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06D38C76-98D2-41F1-9F0B-CEE05215AB4A"
            },
            {
              "criteria": "cpe:2.3:a:apache:nifi:1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01B8572D-CA8D-4A41-B94A-A393A22B5B9D"
            },
            {
              "criteria": "cpe:2.3:a:apache:nifi:1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "76FDA5E5-6A45-4979-9317-75623A59089F"
            },
            {
              "criteria": "cpe:2.3:a:apache:nifi:1.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF1BEC26-CB83-4209-893D-5EA6E08A0C4B"
            },
            {
              "criteria": "cpe:2.3:a:apache:nifi:1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A509533F-ACD6-4290-BE2E-3EDBED60D43B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}