TI-2017-11477 Aliases CVE-2017-15703 GHSA-xwx6-vmj4-5rv8

Deserialization of untrusted data in Apache NiFi

LOW 24CWE-502Published 2018-01-25 · Updated 2024-09-16

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

Why it matters now

EPSS 0.00862 58th percentileScored 2026-11-07

Fix Fixed org.apache.nifi:nifi-framework-cluster-protocol (Maven): 1.5.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache NiFi	1.0.0 - 1.3.0	—	No fix listed	CNA
—	org.apache.nifi:nifi-framework-cluster-protocol (Maven)	before 1.5.0	1.5.0	Patch available	GHSA-xwx6-vmj4-5rv8

Apache NiFi VendorApache Affected 1.0.0 - 1.3.0 Fixed in — No fix listed CNA
org.apache.nifi:nifi-framework-cluster-protocol (Maven) Vendor— Affected before 1.5.0 Fixed in 1.5.0 Patch available GHSA-xwx6-vmj4-5rv8

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:nifi::::::::	1.0.0 – 1.4.0	Vulnerable	Apache

cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:* Versions 1.0.0 – 1.4.0 Vulnerable ·Apache

Remediation

Fix · GHSA-xwx6-vmj4-5rv8 org.apache.nifi:nifi-framework-cluster-protocol (Maven) Fixed in 1.5.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2017-15703
2026-10-03 Alias added: GHSA-xwx6-vmj4-5rv8

References

Advisory 1

https://nifi.apache.org/security.html#CVE-2017-15703

Other 1

https://github.com/apache/nifi/commit/9e2c7be7d3c6a380c5f61074d9a5a690b617c3dc

TI-2023-17293 Apache NiFi: Potential Code Injection with Database Services using H2 CVSS 3.1HIGH 8.8
TI-2020-16549 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1MEDIUM 5.3
TI-2019-07411 Deserialization of untrusted data in Apache Commons Beanutils CVSS 3.1HIGH 7.3
TI-2017-11471 Improper input validation in Apache NiFi CVSS 3.0CRITICAL 9.8
TI-2018-01212 XML external entity injection in Apache NiFi CVSS 3.0CRITICAL 9.8
TI-2021-03489 Deserialization of untrusted data in jackson-databind CVSS 3.1HIGH 8.1

See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences