{"id":"CVE-2017-15703","aliases":["EUVD-2019-0720","GHSA-xwx6-vmj4-5rv8"],"status":"published","title":"Denial of service via deserialization attack in nifi","description":"Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.","severity":{"version":"3.0","score":5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00862,"percentile":0.58809,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2018-01-25T21:00:00Z","modified":"2026-10-24T10:30:53Z","fixes":[{"ecosystem":"Maven","package":"org.apache.nifi:nifi-framework-cluster-protocol","fixed_in":["1.5.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.nifi:nifi-framework-cluster-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.nifi:nifi-framework-cluster-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0"}]}],"versions":["0.0.1-incubating","0.0.2-incubating","0.1.0-incubating","0.2.0-incubating","0.2.1","0.3.0","0.4.0","0.4.1","0.5.0","0.5.1","0.6.0","0.6.1","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","1.0.0","1.0.0-BETA","1.0.1","1.1.0","1.1.1","1.1.2","1.2.0","1.3.0","1.4.0"]}],"products":[{"vendor":"apache","product":"nifi"},{"vendor":"apache software foundation","product":"apache nifi"}],"references":[{"url":"https://nifi.apache.org/security.html#CVE-2017-15703","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/apache/nifi/commit/9e2c7be7d3c6a380c5f61074d9a5a690b617c3dc","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xwx6-vmj4-5rv8"}],"sources":{"cve":[{"id":"CVE-2017-15703","description":"Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.","status":"published","published":"2018-01-25T21:00:00Z","modified":"2024-09-16T22:20:47.668Z","updated_at":"2026-11-02T14:33:14.271248Z"}],"euvd":[{"id":"EUVD-2019-0720","description":"Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.","status":"published","published":"2018-01-25T21:00:00Z","modified":"2024-09-16T22:20:47Z","updated_at":"2026-11-03T00:55:03.975609Z"}],"ghsa":[{"id":"GHSA-xwx6-vmj4-5rv8","title":"Denial of service via deserialization attack in nifi","description":"A vulnerability found in Apache NIFI before 1.5.0-RC1. Attacker can perform XXE attacks through JAXB.","status":"published","published":"2019-10-25T19:42:50Z","modified":"2023-01-09T05:01:57Z","cvss":[{"version":"3.0","score":5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"nvd":[{"id":"CVE-2017-15703","description":"Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.","status":"published","published":"2018-01-25T21:29:00.207Z","modified":"2026-06-17T01:08:07.57Z","cvss":[{"version":"3.0","score":5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:04:13.257031Z"}],"osv":[{"id":"CVE-2017-15703","description":"Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.","status":"published","published":"2018-01-25T21:29:00.207Z","modified":"2026-10-24T10:30:53.208779393Z","cvss":[{"version":"3.0","score":5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"GHSA-xwx6-vmj4-5rv8","title":"Denial of service via deserialization attack in nifi","description":"A vulnerability found in Apache NIFI before 1.5.0-RC1. Attacker can perform XXE attacks through JAXB.","status":"published","published":"2019-10-25T19:42:50Z","modified":"2023-11-08T03:58:58.180714Z","cvss":[{"version":"3.0","score":5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:47:00.604718Z"}]}}