CVE-2016-8748
Cross-site Scripting in Apache NiFi
CVE-2016-8748 is a medium vulnerability (CVSS 5.4) in Apache Nifi, published October 19, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.99%, the 81st percentile. Fixed in org.apache.nifi:nifi 1.0.1.
- Severity
- 5.4 MediumCVSS 3.0, NVD
- Exploit chance
- 1.99%EPSS, 81st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.0.1org.apache.nifi:nifi +2 more
Description
In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.nifi:nifiMaven | before 1.0.1 | 1.0.1 |
org.apache.nifi:nifiMaven | 1.1.0 up to 1.1.1 | 1.1.1 |
org.apache.nifi:nifiMaven | before 1.0.1, plus listed versions 0.0.1-incubating0.0.2-incubating0.1.0-incubating0.2.0-incubating0.2.1 Show 14 moreShow less0.3.00.4.00.4.10.5.00.5.10.6.00.6.10.7.00.7.10.7.20.7.30.7.41.0.01.0.0-BETA | 1.0.1 |
What each source reports
NVD Score used
In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.
- Record
CVE-2016-8748- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.
- Record
CVE-2016-8748- Updated
- 2026-11-02
EUVDEUVD-2022-3860No score
In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.
- Record
EUVD-2022-3860- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g2fm-x3cp-mqw9
Cross-site Scripting in Apache NiFi
In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.
- Record
GHSA-g2fm-x3cp-mqw9- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.
- Record
CVE-2016-8748- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-g2fm-x3cp-mqw9
Cross-site Scripting in Apache NiFi
In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.
- Record
GHSA-g2fm-x3cp-mqw9- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.