Not rated
CVE-2018-17193 The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization,…
Description
The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack. Mitigation: The fix to correctly parse and sanitize the request attribute value was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache NiFi | Versions not published |
Other CVEs of Apache NiFi
The 47 CVEs of Apache NiFi →
CVE-2026-70469
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests…
Not rated
CVE-2026-81866
Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not…
0.5
Low
CVE-2026-82561
Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a…
5.9
Medium
CVE-2026-86089
Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API…
2.3
Low