CVE-2016-8748 Cross-site Scripting in Apache NiFi

What is CVE-2016-8748?

CVE-2016-8748 is a medium-severity cross-site scripting vulnerability in Apache Nifi, published on 19 Oct 2017. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.

Weakness: CWE-79

Which versions are affected by CVE-2016-8748?

4 open source packages ship an affected version, including org.apache.nifi:nifi. It affects 1 product.

Products include Apache Nifi.

How do I fix CVE-2016-8748?

Upgrade org.apache.nifi:nifi to a fixed version for your release line: 1.0.1 or 1.1.1.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2016-8748 being exploited?

There is no known exploitation of CVE-2016-8748 in the wild and no public exploit code.

Other vulnerabilities in Apache Nifi

• CVE-2018-1309 Improper Restriction of XML External Entity Reference in Apache NiFi Critical 9.8
• CVE-2017-15697 Apache NiFi XSS issue in context path handling Critical 9.8
• CVE-2017-5636 Injection in Apache NiFi Critical 9.8
• CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests High 8.8
• CVE-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources High 8.8

All Apache Nifi vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g2fm-x3cp-mqw9.