CVE-2017-5636
CriticalSummary
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user.
Risk Assessment
An attacker could gain another user's permissions, potentially leading to unauthorized access to data and resources within the cluster.
Recommendation
It is recommended to upgrade Apache NiFi to version 0.7.2 or 1.1.2 and to monitor logs for potential attack attempts.
Original NVD description (English source)
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node.