GCVE - cpe:2.3:a:apache:nifi:1.1.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:nifi:1.1.1:*:*:*:*:*:*:*

part: a version: 1.1.1 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Nifi (`c50d5476-8f35-5ca2-94ef-ba428d97a1b7`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/nifi`	purl2cpe	2026-06-01 10:14:28.274552
`pkg:docker/apache/nifi`	purl2cpe	2026-06-01 10:14:28.274553
`pkg:github/apache/nifi`	purl2cpe	2026-06-01 10:14:28.274554
`pkg:maven/org.apache.nifi/nifi`	purl2cpe	2026-06-01 10:14:28.274556

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-7667`	vulnerable	2026-06-08 05:10:05.741817	Details available Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin. Published: 2017-06-12T16:00:00.000Z Updated: 2024-08-05T16:12:27.709Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/99018 https://lists.apache.org/thread.html/d779d6129de1a5aa149c219b2fc6e9e78156614eaac92a89cbaf9bce%40%3Cdev.nifi.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-7665`	vulnerable	2026-06-08 05:10:05.732219	Details available In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient. Published: 2017-06-12T16:00:00.000Z Updated: 2024-08-05T16:12:27.928Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/99009 https://lists.apache.org/thread.html/d779d6129de1a5aa149c219b2fc6e9e78156614eaac92a89cbaf9bce%40%3Cdev.nifi.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-5636`	vulnerable	2026-06-08 05:09:47.388122	Details available In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node. Published: 2017-10-19T20:00:00.000Z Updated: 2024-08-05T15:04:15.356Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/96731 https://nifi.apache.org/security.html#CVE-2017-5636	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-5635`	vulnerable	2026-06-08 05:09:47.387623	Details available In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user. Published: 2017-10-19T20:00:00.000Z Updated: 2024-08-05T15:04:15.431Z Open on db.gcve.eu Reference links https://nifi.apache.org/security.html#CVE-2017-5635 http://www.securityfocus.com/bid/96730	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-12623`	vulnerable	2026-06-08 05:08:47.396775	Details available An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release. Published: 2017-10-10T18:00:00.000Z Updated: 2024-09-16T16:17:35.807Z Open on db.gcve.eu Reference links https://nifi.apache.org/security.html#CVE-2017-12623	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.